Supplier Security
Do You Know Who Your Technology Partners Really Are?
A supplier's own assurance statement is only one part of the picture. Map the people, organisations and access that sit behind a service.
7 min read — Altitude IT Support
Many business services depend on organisations a customer never sees: subcontractors, cloud providers, support teams, data processors and research or technology partners. The question is not whether every supplier is dangerous. It is whether the business understands which relationships matter, what information or systems they can reach and how that access is controlled.
What the MI5 warning does—and does not—establish
On 30 September 2026, MI5 published an espionage alert about the China General Technology Research Institute (CGTRI). MI5 said the institute had strong ties to China's Ministry of State Security and alleged that its funding supported research that could improve espionage capability. The Chinese Embassy in the UK rejected the accusations as fabricated. These are opposing official statements; a security alert is not a court judgment establishing every allegation as fact.
The warning is directed at research relationships and the origin of funding. It should not be turned into a claim about every Chinese supplier, every university collaboration or every company in a particular country. For a business, the transferable lesson is to establish who is actually behind a service and what access or information a relationship creates, then assess the evidence in context.
Map the relationship, not just the contract name
Start with services that could affect a critical business process or expose confidential information. Confirm the contracting organisation, its parent or controlling interests where relevant, the subcontractors that deliver the service and any parties that can access business data. Ask where support is performed, what information is available to staff and how a supplier's involvement changes if its ownership or operating model changes.
For an IT provider, check the administrative accounts and remote-support routes used to reach your systems. A supplier may hold a named account, a shared support identity, a delegated cloud role or access through another service. Record the business purpose and scope for each route. Restrict permissions to the minimum needed, monitor access and remove it when a contract or task ends. Apply the same review to data-processing arrangements and to partners who receive designs, customer records or other intellectual property.
Ask for evidence that can be checked
- A current list of subcontractors and other organisations that handle your data or support your systems.
- The legal entity responsible for the service, plus relevant ownership or funding information for a high-risk relationship.
- A list of supplier identities and permissions in your tenant, with owners, purpose and last review date.
- Access logs, incident-notification terms and a practical description of how suspicious supplier activity is investigated.
- Contract terms for confidentiality, data use, security responsibilities, deletion, termination and removal of access.
Ask your IT provider to distinguish what it has verified from what a third party has asserted. Certifications and questionnaires can help, but neither automatically proves that a particular account is controlled properly or that a subcontractor relationship is understood.
Keep assurance proportionate and current
Not every supplier needs the same level of investigation. A low-risk supplier with no access to business information is different from a remote administrator, a processor of sensitive records or a partner receiving valuable intellectual property. Set review depth according to what could happen if the supplier failed, was compromised or changed its use of information. Revisit the decision when access expands, a subcontractor changes or the contract is renewed.
Cyber Essentials can help demonstrate a baseline of technical controls against common internet-based threats. It is useful evidence, but it is not a complete supply-chain assurance programme and does not replace checking data access, contractual responsibilities, ownership or offboarding. The NCSC's supply-chain playbook can help organisations make reviews more structured and proportionate.
A supplier-access review you can run now
- List external organisations with access to your systems, data or facilities.
- For each one, record the service, business owner, information handled and access route.
- Check the supplier's subcontractors, relevant processing terms and the evidence available.
- Remove inactive accounts, narrow excessive privileges and record approved exceptions.
- Set a review date and a clear owner for changes, incidents and contract termination.
Altitude IT's existing article on where business data lives across SaaS services looks at cloud applications and data connections. This article extends the question to ownership, funding, research relationships and the people behind third-party access. Could you produce a reliable list of every external organisation with access to your business systems today?