Supplier Cyber Security: How to Check Your Suppliers
Short answer: supplier cyber security means knowing which outside firms can reach your data or systems, and asking each of them a handful of plain questions about how they protect it. For a small business that’s usually five to ten suppliers: your IT provider, your accountant or payroll bureau, your practice or case management software, your website host and anyone with remote access. You don’t need an audit team. You need a list and ten questions.
Most small businesses think about cyber security as their own problem: their laptops, their passwords, their email. But some of the most sensitive data you hold lives with someone else. Your payroll bureau has every employee’s bank details. Your IT provider has admin access to everything. Your cloud software holds your client records. If one of them is breached, it’s your data and your clients who are affected, and often your name on the letter.
Not sure which of your suppliers can reach what? Ring 0151 452 3060 and a person picks up. We’ll help you map it.
Step 1: list the suppliers who can reach your data
Start with a simple list. For each supplier, write down what they can access and how. The ones that matter most fall into four groups:
- People with access to your systems: your IT provider, any software vendor with remote support access, a freelance developer.
- People holding your data: payroll, accountants, HR platforms, CRM and practice management software, cloud storage.
- People handling your money: banks, payment processors, anyone who can change bank details on an invoice.
- People running your front door: website host, domain registrar, email provider.
Most small businesses find two or three suppliers on that list they’d forgotten about, usually a piece of software someone signed up for years ago that still holds client data.
Step 2: ask each supplier these ten questions
Send them as an email, not a form. A supplier who takes security seriously will answer quickly. One who can’t answer is telling you something too.
- Do you hold Cyber Essentials or Cyber Essentials Plus, or an equivalent such as ISO 27001?
- Is multi-factor sign-in enforced for all your staff who can access our data?
- Where is our data stored, and does it stay in the UK or the EU?
- Who on your side can access our data, and how is that access controlled?
- How and when would you tell us if you had a breach that affected our data?
- How is our data backed up, and how quickly could you restore it?
- If you have remote access to our systems, how is it secured and logged?
- Do you use subcontractors who can reach our data, and who are they?
- What happens to our data if we stop working with you?
- Who do we contact about a security concern, and how fast do they respond?
You’re not grading them. You’re finding the gaps you’d otherwise discover the hard way.
Step 3: pay most attention to your IT provider
Your IT provider usually has more access than anyone: admin rights to Microsoft 365, remote access to every machine, and often the backups too. That makes their security your security. Ask them the ten questions above, and three more: do their engineers use separate admin accounts with multi-factor sign-in, is their remote access tool locked down and logged, and could they show you who accessed your systems last month?
A good provider will have ready answers. If yours doesn’t, our guide to switching IT provider explains what moving actually involves.
Want a second opinion on a supplier’s answers? We’ll read them and tell you what’s solid and what isn’t. Ring 0151 452 3060 or see managed cyber security.
Step 4: limit what suppliers can reach
The questions tell you how a supplier protects your data. The next step is making sure they can only reach what they need. Separate accounts for each supplier, never shared logins. Access that’s switched on when they need it and off when they don’t. And removing access the day a supplier relationship ends. We cover that in detail in managing supplier access.
Step 5: write it down and review it once a year
Keep the list, the answers and the date you asked. Review it once a year and whenever you add a supplier. It takes an hour, and it’s exactly the evidence a client, insurer or regulator will ask for if something goes wrong. DSIT’s 2025 survey found 43% of UK businesses reported a breach or attack in the previous year. The ones that recover fastest are the ones who already know who holds what.
What this looks like when it goes wrong
Supplier breaches aren’t hypothetical. In 2023, a flaw in the MOVEit file transfer software was used to steal data from payroll provider Zellis, exposing staff details for employers including British Airways and Boots. None of those employers was attacked directly. We look at what small businesses can learn from that and other cases in real supply chain attacks, and the lessons for small firms.
The other side of this is that you’re a supplier too. If a bigger client sends you a security questionnaire, see when your customers check your cyber security.
Start with the list. If you’d like help building it, or checking what your IT provider can reach, book fifteen minutes with Eric this week. Ring 0151 452 3060 and a person picks up.