Supplier Relationships
Description
Information security measures with suppliers documented + monitored.
⚠️ Risk Impact
Korean enterprises rely heavily on vendor ecosystems; supplier security inherits to the customer.
🔍 How EchelonGraph Detects This
EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.
🔧 Remediation
Vendor risk register. Annual SOC 2 / ISO 27001 collection. Contractual breach-notification SLAs.
💀 Real-World Attack Scenario
A Korean SaaS used a vendor that experienced a breach affecting their data. No BAA-equivalent existed; full liability inherited.
💰 Cost of Non-Compliance
Supplier-related breaches: avg ₩2-5 billion per incident.
📋 Audit Questions
- 1.Vendor risk register?
- 2.Annual attestations?
- 3.Breach-notification SLAs?
🎯 MITRE ATT&CK Mapping
⚡ Common Pitfalls
- ⛔Informal vendor agreements
- ⛔Annual attestations not collected
- ⛔No breach-notification SLA
📈 Business Value
Vendor risk management closes a category of inherited exposure.
⏱️ Effort Estimate
Annual vendor review
EchelonGraph tracks vendor attestation freshness
🔗 Cross-Framework References
Automate ISMS-P ISMS-2.11 compliance
EchelonGraph continuously monitors this control across all your cloud accounts.
Start Free →