Mission 21
Third-Party Risk and Supply Chain Protection
Your IT provider, accountant, web developer and software vendors can all reach into your business. This mission shows owners and managers how to know who has access, give them only what the job needs, and close the door cleanly when the work ends.
In this mission you will
- List the suppliers and service providers who can access your systems, data or money, and rank them by how much they matter.
- Apply least-privilege, time-limited access when a vendor needs to do a job.
- Set basic security expectations with suppliers, including how they will tell you about a problem.
- Offboard a vendor safely by removing access, recovering data and changing shared credentials.
Your security includes everyone you let in
Most small businesses depend on outside help. A local IT partner fixes laptops and manages email. A chartered accountant logs in to the accounting software. A freelance developer looks after the website. A cloud vendor stores invoices. Each of these relationships is useful, and each one is also a door into your business. If a supplier’s laptop is compromised, or a former freelancer still has an admin login, the attacker does not need to break through your defences. They simply walk in using trusted access. Third-party risk is not about distrusting suppliers. It is about knowing who holds keys, and making sure each key opens only what it should.
Who counts as a third party?
- IT service providers and managed support partners who can reach laptops, servers, email or Wi-Fi.
- Accountants, tax consultants and payroll agencies with access to financial systems or employee data.
- Web developers, designers and digital marketing agencies with logins to your website, domain, social media or ad accounts.
- Software and cloud vendors that store your data, such as accounting, billing, CRM or file-sharing tools.
- Logistics, payment and marketplace partners connected to your orders, customer details or collections.
- Anyone else who holds a password, a remote-access tool, a shared account or a copy of your data.
Build a simple supplier access list
- 1Write down every supplier who touches your systems, data or payments. Include freelancers and family friends who ‘help with IT’.
- 2For each one, note the service they provide, what they can access, and whether access is permanent or occasional.
- 3Mark how critical they are: could your business keep running for a week without them? Could they leak customer or financial data?
- 4Name an internal owner for each supplier: the person who approves their access and is their point of contact.
- 5Record the renewal or contract end date and an exit contact, so offboarding is never forgotten.
- 6Review the list at least every six months, and whenever a supplier changes.
Least privilege for vendors
Give a vendor only the access needed for the approved task, for the shortest practical time. A developer updating one page does not need permanent control of your domain registrar. An accountant filing returns does not need to approve payments. Where possible, create a separate named account for each vendor instead of sharing an owner login, turn on multi-factor authentication, and set an end date. Keep owner-level accounts, such as the domain registrar, main email administrator and bank login, in the hands of the business. If a vendor must have temporary admin rights, agree the start and end time, and remove the access when the job is done.
Basic expectations to agree with suppliers
- Who in their team will access your systems, and that each person uses their own login.
- That they will tell you promptly if they suspect a security incident that could affect you, and who they will contact.
- How they protect your data, and whether they use any subcontractors who will also see it.
- How backups, recovery and support will work if their service fails.
- What happens at exit: return or deletion of your data, handover of documentation, and removal of all access.
- These do not need a long legal contract for small suppliers. A clear email or a one-page annexure, agreed in writing, is far better than nothing. For larger contracts, ask a qualified adviser to review the terms.
Offboarding a vendor cleanly
- 1Disable or delete their accounts on every system on your list, including email, website, cloud tools and remote-access software.
- 2Change any shared passwords they knew, starting with the most critical accounts.
- 3Remove any remote-access tools they installed, and check for forwarding rules or extra admin users they may have created.
- 4Ask for return or confirmed deletion of your data, and collect documentation they hold, such as network settings or website files.
- 5Update the supplier list with the end date and who completed the offboarding.
Practical business example
Sai Krupa Pharma Distributors closes an old door
Sai Krupa Pharma Distributors, a fictional 30-person medicine wholesaler in Hyderabad, had used three different IT technicians over six years. When the owner, Lakshmi, finally made a supplier access list, she found that the first technician still had remote-access software on the billing computer. A web freelancer who left two years ago was still listed as an administrator on the website. The domain itself was registered under the current IT partner’s personal email. Nothing bad had happened, but every one of these was an open door. Lakshmi asked the current partner to remove the old remote tool and the former freelancer’s account, and to move the domain into a business-owned email with MFA. She created separate named logins for the partner and the accountant, and added a renewal date and exit contact for each supplier. The list now sits in a shared sheet she reviews twice a year.
The lesson: Risk often hides in relationships that ended quietly. A simple list showed Lakshmi where old access remained, and clear ownership made the clean-up quick and calm.
Key takeaways
- Every supplier with access to your systems, data or money is part of your human wall, so know who they are and what they can reach.
- Rank suppliers by how critical their service is and what access they hold, not by contract value alone.
- Give vendors named, minimum, time-limited access, and keep owner-level accounts such as domain, email admin and banking in the business’s control.
- Agree basic expectations in writing: incident notification, data handling, subcontractors and what happens at exit.
- Offboard vendors as carefully as employees: remove access, change shared passwords, recover data and record it.
Scenario lab · +25 XP
The developer who wants the master key
You manage operations at Kaveri Organics, a fictional 20-person food brand in Mysuru that sells online. A freelance web developer is fixing a checkout page. He messages: ‘Please give me full admin access to the domain registrar account, permanently. It will save time whenever I need anything.’ Today’s change only needs a small update on the website hosting panel.
Fictional scenario. Never enter real passwords, OTPs or customer details anywhere in this course.
Decision 1 of 3
How do you respond to the request for permanent registrar admin access?
Knowledge check · +20 XP on mastery
Check your understanding
Practical action · +40 XP (self-reported)
Build your critical supplier access list
Create a short list of the suppliers who matter most to your systems and data. Describe access in general terms only. Do not write down passwords, account numbers or customer details.
- 1.List your five most critical suppliers or service providers, starting with whoever manages IT, email, website and finances.
- 2.For each, note the service, what systems or data they can access, and whether access is permanent or occasional.
- 3.Name an internal owner who approves their access and is their main contact.
- 4.Add the renewal or contract end date and an exit contact for each supplier.
- 5.Mark one supplier whose access is broader than needed, and agree a date to reduce it.
- 6.Set a reminder to review the list in six months.
Do this in your own records. Don’t enter passwords, OTPs, customer data or incident details here.
Mission status: Not started
A mission is complete when you have read the lesson, answered the knowledge check and acknowledged the practical action. Mastery means scoring at least 3 of 4 on the knowledge check.
View my progress