Suppliers and subcontractors: securing the chain
Complete plan
Three modules for purchasing, IT and project owners: the four questions to ask before signing with a supplier (data and access, a questionnaire sized to the risk, the GDPR processor contract, hosting), a provider's remote access set in six points, and the right reflexes when a supplier has been hacked.
- 8 min
- 3 modules
- 9-question check
- English · Français
- Attestation
You will be able to
- List what the supplier will receive: which data, which access to your systems
- Give each of a provider's technicians an account in their own name, protected by multi-factor authentication, never a shared account or an internal admin's
- Alert IT security at once, the DPO if personal data may be affected, and management
Programme
3 modules · 8 min-
New supplier: four questions before you sign 3 min
- List what the supplier will receive: which data, which access to your systems
- Size the security questionnaire to the risk and ask for evidence from a supplier that gets data or access
- Require the GDPR processor contract and know where the data is hosted and accessed from, before signing
-
A provider connects to your systems 2 min
- Give each of a provider's technicians an account in their own name, protected by multi-factor authentication, never a shared account or an internal admin's
- Limit access to the systems and rights needed, for the time of the job, opened on demand and logged
- Remove accounts, access and tools at the end of the job or contract, and change the passwords the provider knew
-
Your supplier has been hacked 2 min
- Alert IT security at once, the DPO if personal data may be affected, and management
- Ask the supplier, in writing, what is affected, since when, what has been done, which signs to watch and who the contact is
- Suspend its access and connections, change shared passwords and keys, and check any invoice or request from its mailbox through a known number
-
Knowledge check
9 questions, pass mark 80 %. Explanations after each answer; you can try again.
-
Attestation
One per person, with the date, the score and the frameworks covered — anyone can check it online with its code.
Version 1 · updated October 6, 2026