Supply Chain Security Should Work Both Ways — So Why Doesn’t It?

By Richard McBarnet, Managing Director, Lumina Technologies

Most people in engineering and manufacturing understand how supply chain security pressure works. A larger firm turns around to a smaller supplier and says: “We’ve done an audit and we’ve found areas of non-compliance. If you want the contract, you’re going to have to fix it.”

That’s entirely reasonable. The smaller firm comes to their IT provider, says “fix it,” and it gets fixed. If the IT provider refused or couldn’t deliver, they’d lose the client. Most people would say that’s obvious. The pressure flows downward through the supply chain, and everyone along the way has to meet the standard or lose the work.

But we’ve seen it working in reverse. And that’s where it gets interesting.

When The Pressure Goes Upward, It Can Get Ignored

We’ve had situations where our clients — smaller engineering firms — are working with larger providers. That larger company needs to access our client’s systems, collaborate on data, or work within a shared environment. So we say: “In order to have access to these systems, your devices need to be compliant.”

Entirely reasonable. The same kind of requirement that flows downward through supply chains every day.

But because they’re the larger provider and they’ve got more muscle, they say no. They’re not going to do it.

Now, in theory our client could say: “Fine, we’re not paying you then.” But the reality is that the larger firm could easily go and find someone else. So there’s a lopsided dynamic — justifiable pressure downward, but when the same pressure is applied upward, it gets pushed back.

The Assumption That Size Equals Security

There’s an unspoken assumption behind that pushback: “We’re bigger, therefore we’re already secure.” But that’s not how it works.

We see time and time again critical infrastructure being brought down by avoidable compromises — things that really shouldn’t have happened. It is by no means a given that large companies are better at compliance than smaller ones. In fact, larger organisations often move slowly, run complex legacy estates of their own, and have gaps that would surprise people.

In big supply chains, it only takes one link in the chain to break to potentially compromise the whole thing. That’s true whether that link is a 15-person machining shop or a multinational with thousands of employees.

Everyone’s Got To Do Their Part

The regulatory landscape is moving in the right direction. More and more oversight is mandating that larger organisations meet the same standards they impose on their suppliers. And by and large, people do comply. But it’s not universal, and it’s not automatic.

If you’re a smaller engineering firm being asked to prove your security to larger clients — which is right and reasonable — it’s worth asking the question in the other direction too. What standards are the businesses accessing your systems being held to? Are their devices compliant? Are they meeting the same bar they’re setting for you?

Supply chain security only works if everyone does their bit. The pressure has to exist upward as well as downward. Otherwise, you’ve secured your end of the chain while leaving the door open at the other.

 

– Richard McBarnet, IT Expert & Lumina CEO

---

Lumina Technologies specialises in IT and cyber security for engineering and precision manufacturing firms. If supply chain security is on your agenda, contact us via the contact form along the side, or call 01442 500 890.