Third-party vendor risk is one of the least-managed security risks in NZ small business. You carefully secure your own systems — but your accountant's practice management software, your legal firm's document portal, and your IT provider's remote management tools all have access to your environment. What happens when they're compromised?
In 2023, the MOVEit file transfer software — used by thousands of organisations globally to securely share files — was compromised through a SQL injection vulnerability. Attackers exploited the vulnerability to exfiltrate data from every organisation using the software. Among the affected: law firms, accounting practices, and government agencies worldwide.
For organisations that used MOVEit to exchange documents with professional services providers, the breach exposed their data even though their own systems were entirely secure. Their data was in someone else's compromised environment.
Mapping Your Third-Party Risk
To understand your third-party vendor risk, map every external organisation that has any form of access to your data or systems: your IT provider (privileged remote access), your accountant (financial records), your legal advisor (contracts and correspondence), your cloud software vendors (CRM, ERP, payroll), your recruitment platform (employee data), and any industry-specific software used to store customer information.
For each vendor, ask: What data do they hold? What access do they have? What would a compromise of their systems mean for our data? This mapping exercise typically reveals more exposure than expected.
What You Can Actually Control
You can't control a supplier's security posture directly — but you can: limit the access you give them (principle of least privilege applied to vendor relationships), review and revoke OAuth/API access for services no longer actively used, ask vendors about their security certifications and incident notification policies, and include data handling requirements in supplier agreements.
For high-risk vendors (those with access to sensitive data or privileged system access), request evidence of their security practices — ISO 27001 certification, SOC 2 reports, or at minimum a completed security questionnaire. A vendor unwilling to provide this is itself a risk signal.
Your security posture includes the security posture of every vendor that holds your data or has access to your systems. This is the risk that's hardest to see and easiest to overlook — until a supplier breach puts your business data on a ransomware group's leak site.
