Recently, Qantas found itself in the spotlight—not because of a direct breach to its own systems, but because one of its third-party providers was compromised. This incident is a timely reminder that, your security is only as strong as the weakest link in your supply chain. As someone who recently travelled with Qantas, this incident was an eye-opener for me as well.
Many organisations invest heavily in their own cyber defences, but overlook the risks introduced by third-parties (i.e. vendors and service providers) who often have access to sensitive data or internal systems. When these third-parties are breached, the fallout can be just as damaging as if your own systems or services were attacked.
Why Third-Party Assurance Matters:
- Shared access: Many third parties have access to organisation systems and/or sensitive customer data.
- Reputation damage: Customers often don’t differentiate between your organisation and your service providers or vendors. If data is compromised, your brand takes the hit.
- Accountability and regulatory exposure: you are ultimately accountable even when the breach is to a third party. Data privacy laws like the Privacy Act 2020 in New Zealand or the GDPR in Europe require you to ensure your data is protected, even when managed by third parties.
We have too many third parties; how can we handle all of those?
- Classify your third parties — classify your third parties in tiers based on preset, business-relevant criteria such as sensitivity of data accessed, criticality to your business operations, value of contracts, etc.
- Independent assurance reports — capitalise on existing independent assurance they may have such as ISO 27001 certifications or SOC 2 Type II audits. Make sure you consider the scope and artefacts.
- Conduct initial due diligence before onboarding any third party — evaluate their security posture, certifications, data handling practices, and incident history.
- Establish strong contracts with clear expectations around data security, breach notifications, and compliance requirements.
- Monitor continuously — security isn’t a one-time activity. Conduct regular audits to ensure your vendors remain compliant. Maintain a consolidated view of third-party assurance and results for better oversight and decision-making.
- Have an exit strategy — have a complete exit strategy that includes regular and portable data backups, clearly defined contract termination clauses, immediate access revocation procedures, and pre-identified alternative providers.
Have you reviewed your vendors lately?
If you haven’t done any due diligence on your third-party providers, now is the time to act. Don’t wait for an incident to remind you of the risks. Contact Axenic today—we can help assess your third-party exposure and build a stronger, safer supply chain.