Protecting the supply chain in an era of disruptions

Business continuity planning is an important but often overlooked aspect of managing enterprise risk. This year, the COVID-19 pandemic has made it clear to risk and security professionals—and their enterprises—that business continuity must be an organizational focal point, with supply chain continuity being an especially critical area to solidify.

Many enterprises today outsource a variety of business- and technology-related processes, making successful and reliable supply chains essential for their survival. Eight in 10 (79%) of companies with high-performing supply chains achieve revenue growth above average within their industries. But maintaining that reliability in a fast-moving era of digital disruption requires a concerted commitment to assessing threats and managing gaps in continuity plans.

While supply chain problems encountered during the COVID-19 pandemic are top of mind for many organizations, other major events in the not-too-distant past (from natural disasters to terrorist attacks and cyberattacks) have underscored the need for resilient supply chains. In fact, cybersecurity incidents increasingly are among the common causes of supply chain disruption. A study from Resilience360 finds that there were around 300 cybersecurity incidents that impacted supply chain entities last year, with many of those attacks coming in the form of ransomware.

Assess your supply chain partners’ security

Unfortunately, attacks on supply chains is a trend that is likely to escalate in the months and years to come. Earlier this year, even before the COVID-19 pandemic took center stage, the US Federal Bureau of Investigation issued a security alert to companies in the private sector regarding a hacking campaign targeting supply chain software providers. The bottom line: inadequate security and incident management procedures within supply chain ecosystems can result in major interruptions to an enterprise’s business operations. Therefore, enterprises need to vet the security capabilities of their supply chain partners on an ongoing basis. This holds particularly true in the aftermath of the current pandemic and resulting economic fallout, as some suppliers might no longer be in the economic position to implement the security safeguards that they previously had in place.

Whatever coordinating is done with existing suppliers, it is imperative in this era to rethink business models and enable a more digital enterprise by transforming products and services. As enterprises re-imagine themselves and how technology can best be leveraged to drive growth and innovation, their transformations will often lead them to engage with new vendors and suppliers. Suppliers can be categorized into four major groups: strategic, tactical, commodity and niche. Each group carries its own set of potential risks that need to be mitigated. For example, instead of relying upon only one supplier for commodities (suppliers of materials and parts), continuity can be bolstered by utilizing multiple suppliers, while niche suppliers of exclusive components require extra vetting if they are essential to the product’s distribution because they can be especially challenging to replace. Before entering into relationships with new supply chain partners, it is critical to understand their security capabilities and the impact any gaps could have on organizational cybermaturity and business continuity.

Address the entire supply chain

Of course, in addition to cybersecurity incidents represent, there are several other threats that can wreak havoc on supply chains, such as hardware and equipment failures, environmental hazards and other continuity crises, including the disruptions to the workforce that have occurred during the COVID-19 pandemic. As indicated in ISACA’s recent white paper, Supply Chain Resilience and Continuity, “A supply chain risk mitigation process should not just focus on supplier-specific risk, but rather address overall supply chain interruptions and their impact on the enterprise as a whole. The mitigation plan should address the entire supply chain rather than a specific supply partner. The risk mitigation process should be both proactive (to ensure adequate controls while establishing the process) and reactive (to include an appropriate incident management process supported by continuity plans).” [Disclaimer: I am a board director of ISACA.]

The ISACA guidance highlights some key best practices in this area, including:

• Monitoring supply chain partners for performance and quality
• Aligning enterprise continuity plans with the plans of supply chain partners
• Avoiding scenarios with single points of failure, ensuring redundancy where possible
• Understanding and maintaining good working relationships

We are in a dynamic and sometimes tumultuous business landscape that presents enterprises with tremendous opportunities but also comes with increasing risks. This is a result of both the pace of technological change and a global business environment with increasing interdependencies. Add in the ever-present possibility of large-scale disasters such as a global pandemic, and the need to prioritize business continuity is evident.

While organizations should always be prepared for the unexpected, the scale of the COVID-19 pandemic has been an eye-opener for many business leaders about the necessity of continuity planning and resilient, dependable supply chains. Planning in advance for what to do when a problem abruptly surfaces—and applying the risk management, governance and security fundamentals to mitigate the potential damage—should remain a high priority long after the current crisis abates.