{"id":11023,"date":"2017-12-14T09:46:00","date_gmt":"2017-12-14T17:46:00","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=11023"},"modified":"2023-06-11T15:53:41","modified_gmt":"2023-06-11T22:53:41","slug":"securing-the-supply-chain-with-risk-based-assessments","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/securing-the-supply-chain-with-risk-based-assessments\/","title":{"rendered":"Securing the supply chain with risk-based assessments"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
At Microsoft, supply chain security means holding our suppliers to the same security standards we apply to ourselves. We created a supply chain assurance program that helps us assess security in third-party software, goods, and services during procurement. Our framework consists of a supplier risk profile and assessments that produce risk indicators and recommend actions. Assessing our suppliers helps us reduce risk in our supply chain and make risk-based decisions.<\/p>\n
Whether it\u2019s caused by poor quality control or a malicious actor, third-party software, solutions, and manufacturers can introduce risk to corporate, employee, and customer data. Microsoft is committed to building and implementing best-in-class security programs and processes, and is constantly working to reduce exposure to cybersecurity risks. Microsoft Core Services Engineering (CSE, formerly Microsoft IT) helps support the overall security mission at Microsoft by offering key security services that help protect corporate data and users. We are also securing the supply chain that we use to procure third-party software, goods, and services that are used at Microsoft.<\/p>\n
An unsecured supply chain can introduce great risk to an organization. If vendor staff aren\u2019t properly vetted, or if we purchase hardware that does not meet our security standards, we can lose data. The factories that build Microsoft products must have a secure infrastructure to ensure that manufacturing data and facilities are secure. As you may have seen in the media, several companies have had data breaches that allowed hundreds of millions of customer records to be compromised. On average, it takes 229 days after a breach for it to be detected. Often, these breaches were caused by a vulnerability in third-party software or services being exploited, costing those companies tens of millions of dollars and damaging customers\u2019 confidence.<\/p>\n
A company is only as strong as its weakest link. We needed a way to help ensure that we hold our suppliers to the same security standards that we apply to ourselves. Our supply chain assurance program helps us evaluate and prioritize the risk level and security of third-party suppliers across Microsoft. Some of the benefits we have seen from introducing a security framework as part of the procurement process include:<\/p>\n
It is important to note that each organization is different; this program and strategy was designed to align with Microsoft business processes. It represents only a few key areas of our assurance program and is not a roadmap for implementation.<\/p>\n
The supply chain assurance program helps inform the procurement process, which includes the business group and leadership approval chain. We use a combination of supplier risk profiling and focused control-based assessments that include:<\/p>\n
The first thing we had to do was create a comprehensive inventory of all the third-party suppliers, software, and services at Microsoft. Once we had this inventory, we could focus on controls and determine where to use profiles and scoring to optimize our resources. But assessing each purchase request for software, services, or hardware is resource intensive and not scalable.<\/p>\n
We created policies, standards, and control procedures for software, goods, and services from third-party suppliers. These policies map to industry regulations and authoritative sources that help us meet both our external and internal security obligations.<\/p>\n
Control procedures give us detailed steps to follow for specific technologies or processes. Our security technical control procedures (TCPs) are created by a board of security experts and are regularly updated to address the latest technology, industry security standards, and best practices.<\/p>\n
We gather information from each supplier and build a risk profile for them. The supplier\u2019s profile is scored for risk based on our experience with past purchases. This score helps us determine how much more assessment we need to give us confidence in their product or service.<\/p>\n
We use a dashboard for at-a-glance information about each supplier and the health of the products or services that they offer. The dashboard, shown in Figure 1, pulls from multiple data sources, including the supplier\u2019s profile score and any documented findings from the supplier risk profiling model.<\/p>\n
<\/p>\n