IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Government consults on steps to bolster supply chain security

Proposals come as the business landscape still reels from high-profile hacks including the SolarWinds Orion Platform attack

The UK government has proposed a number of measures to enhance the security of digital supply chains and third-party IT services in light of a series of devastating cyber attacks.

The Department for Digital, Culture, Media and Sport (DCMS) has opened a consultation on how organisations manage their supply chain risks, with a view to reforming existing guidance and refine a proposed new security framework.

This framework for managed service provider (MSP) security would require MSPs to legally meet the 14 cyber security principles that make up the existing Cyber Assessment Framework. These currently apply only to organisations within the UK critical national infrastructure (CNI) sector, those subjected to the NIS Directive, and businesses managing cyber-related risks to public safety.

Under the proposals, organisations may also be asked to instigate policies to protect devices and prevent unauthorised access, ensure data is protected at rest and transit, keep backups secure and accessible, and train staff in cyber security.

“There is a long history of outsourcing of critical services,” said digital infrastructure minister, Matt Warman. We have seen attacks such as ‘CloudHopper’ where organisations were compromised through their managed service provider. 

“It’s essential that organisations take steps to secure their mission-critical supply chains – and remember they cannot outsource risk.

“Firms should follow free government advice on offer. They must take steps to protect themselves against vulnerabilities and we need to ensure third-party kit and services are as secure as possible.”

The consultation on strengthening supply chain cyber security follows several high-profile attacks against thousands of businesses, described as supply-chain hacks.

One of the scariest of modern history, the SolarWinds Orion Platform hack, was detected in late 2020 and affected countless businesses and public sector organisations. Similarly, the Microsoft Exchange Server attack, more recently, hit at least 30,000 businesses within the US, and many more across the world. 

These are just two of several attacks, including one against CodeCov in which hackers accessed the source code of cyber security firm Rapid7.

The government’s consultation on supply chain cyber security aims to seek views from firms that both procure and provide digital services, asking them whether the UK needs updated guidance or strengthened rules. This call for views is now open and will close on 11 July. 

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download

Most Popular

The top 12 password-cracking techniques used by hackers

The top 12 password-cracking techniques used by hackers

14 Nov 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation
cyber crime

Interpol arrests nearly 1,000 cyber criminals in months-long anti-fraud operation

25 Nov 2022