Glossary · OT cybersecurity
Supply chain security
Also known as: Cyber supply chain security, Supply chain risk management
German: Lieferkettensicherheit
In cybersecurity, supply chain security is the management of risks that arise from suppliers, service providers and third-party components, including compromised software or hardware, insecure development practices, malicious updates and insecure remote access by service partners.
- OT security
In one sentence
Supply chain security manages cybersecurity risks from suppliers, service providers and third-party components, including compromised software or updates.
Example
Before approving a new robot supplier, the plant checks the supplier's vulnerability handling process, requests an SBOM and defines how the supplier's technicians may connect remotely.
Explained in context
Context cards connect this term with others to answer one question. Also in British English and German.
How it applies
- Procurement: Asset owners set security requirements in contracts: IEC 62443 conformity of products and services, vulnerability handling, update support periods, SBOM delivery and rules for remote access.
- Compliance: NIS 2 lists supply chain security, including security aspects of relationships with direct suppliers, among the required risk-management measures. The CRA requires manufacturers to exercise due diligence when integrating third-party components.
- Product development: Suppliers protect their own chain: trusted sources for open-source packages, signed builds, protected signing keys and verified update distribution, so that customers receive exactly the software that was released.
- Documentation: Documentation is part of the supply chain too. Manuals, firmware and certificates should be distributed through authenticated channels, and customers should be told how to verify that files are genuine.
Supply chain security vs. product security
Product security covers the product itself. Supply chain security covers everything the product depends on on its way to the customer: components, tools, suppliers, logistics and update channels.