Board Oversight of Third-Party & Supply Chain Cyber Risk

This tool, featured in the fifth edition of the NACD-ISA Director's Handbook on Cyber-Risk Oversight, provides questions directors can ask to ensure that key components of third-party and supply chain risk management are being managed effectively.

Introduction

While third-party technology and services are essential for business, they introduce significant and escalating risks that can impact profitability and reputation.

This threat is accelerating and expanding. According to Verizon’s 2025 Data Breach Investigations Report, compared to 2024 data “the percentage of breaches where a third party was involved doubled, going from 15% to 30%.” Adversaries are increasingly targeting everything from major software vendors to foundational open-source tools, as seen in the 2024 XZ-utils backdoor incident.

A board’s oversight must now extend beyond the company’s walls to its third- and fourth-party dependencies. This expanded responsibility is underscored by new SEC disclosure rules requiring boards to report on their governance of third-party cyber risk.

Questions the Board Can Ask Management About Third-Party and Supply Chain Cyber Risks

Governance and Strategy — Who Owns This?

Objective: Third-party risk is treated as a core enterprise risk, not a siloed issue, with clear accountability.

• Is there a centralized function or a designated executive who owns this risk across the enterprise, and how does the board receive clear assurance of their effectiveness?
• How is management assessing the impact of new technologies like AI in this risk area?
• How well is our third-party risk management program integrated into our overall enterprise risk management program?
• Do we need to make additional investments into third-party risk management, and are these investments aligned to our business objectives?

Risk Management and Due Diligence — Do We Know Our Exposure?

Objective: A structured process is in place to identify, prioritize, and mitigate risks based on business impact.

• How do we classify vendors based on the criticality of their service and their data access, rather than just on contract size?
• Can management confidently identify our most critical dependencies, including key fourth parties, which could put us at risk?
• What is our strategy for managing risks from new and emerging supply chain dependencies, such as open-source software and the use of AI components?

Resilience and Response — Are We Prepared to Fail?

Objective: The organization can withstand and recover from a related incident.

• Are clear cybersecurity standards and responsibilities defined in our contracts, and more importantly, are they enforceable?
• What are the limits of our liability and insurance coverage for a third-party incident, and are they adequate?
• Have we conducted realistic simulations that specifically model a failure or disruption from one of our most critical third parties?

Real-World Examples of Third-Party and Supply Chain Security Failures

Further Reading

National Institute of Standards and Technology (NIST) Special Publication 800-161: Cybersecurity Supply Chain Risk Management Practices

This is the foundational US Government framework for C-SCRM. It provides comprehensive guidance to organizations on identifying, assessing, and mitigating supply chain risks.

European Union Agency for Cybersecurity (ENISA) Threat Landscape for Supply Chain Attacks

This report provides a crucial European perspective on the threat landscape. It maps and studies supply chain attacks, analyzes attacker techniques, and offers mitigation recommendations tailored to the EU’s regulatory environment.

Return: Toolkit For Action