Supply Chain Attack Prevention Guide
Updated October 2026 to our current guidance. The original reporting date is unchanged.
If you sell to a company bigger than yours, you are part of its supply chain. That is why its security questionnaire asks about your vendors, your updates, and your sign-ins. The customer wants to know two things: that you won’t be the way into its systems, and that your work won’t stop if something goes wrong at one of your own suppliers.
The same logic runs the other way. Your business depends on vendors, software makers, and partners. A supply chain attack goes after one of them and uses that trusted connection to reach you.
Three dated examples show the pattern. In 2020, attackers slipped code into a SolarWinds software update that thousands of organizations installed. In 2023, a flaw in the MOVEit file-transfer program exposed files from organizations that had never heard of the company running it. In 2024, a developer noticed a backdoor planted in XZ Utils, a small open-source component, before it spread widely. In each case one supplier reached many customers.
This guide covers how these attacks work, what lowers your risk, and what to add if you handle Controlled Unclassified Information (CUI) as a federal contractor.
How supply chain attacks work
An attacker gets into a vendor or software provider you use. From there they can:
- Slip harmful code into a software update that your computers download and install automatically
- Steal sign-in details that reach your network through the vendor’s connection
- Take data from the vendor’s systems, including information about your company
- Send convincing emails from the vendor’s real accounts, which they now control
Why the attacker comes through a vendor
A smaller vendor may have fewer people looking after its security than you do. Your systems are set up to let a trusted partner through. And one vendor can lead to hundreds or thousands of its customers.
What to do about it
1. Train your team
- [ ] Teach employees the tricks these attacks use: email attachments, fake invoices, urgent payment requests, and fake sign-in pages
- [ ] Cover emails that come from a vendor’s real account after it has been taken over, which are especially hard to spot
- [ ] Have employees verify unexpected vendor requests another way, by calling a number you already have, never by replying to the email
- [ ] Give employees one place to send a suspicious vendor email for a second look before anyone responds
2. Vet your vendors
Before you sign with a vendor:
- [ ] Look at its security practices as part of your evaluation
- [ ] Ask about certifications such as ISO 27001, SOC 2 Type II, or CMMC (for defense contractors)
- [ ] Send your own short security questionnaire covering data handling, access controls, incident response, and how fast it installs updates
- [ ] Check its history of publicly reported incidents and disclosed flaws
- [ ] Ask how it handles its own software supply chain: a software bill of materials, dependency checks, and code signing
3. Put it in the contract
- [ ] Write security requirements into the contract: two-step sign-in, encryption, update timelines, and data handling
- [ ] Require the vendor to tell you about a security incident within a set time (24 to 72 hours is common)
- [ ] Keep the right to review its security practices
- [ ] Include clauses on liability and cleanup after an incident
4. Keep checking
- [ ] Review your vendors’ security at least once a year
- [ ] Track which vendors can reach your systems, what they can reach, and when they last used it
- [ ] Remove vendor access nobody needs anymore
- [ ] Follow advisories that cover supply chain problems in your industry
Technical controls
Two-step sign-in
- [ ] Require two-step sign-in for every vendor and partner who connects to your systems
- [ ] Use an authenticator app (Microsoft Authenticator or similar) rather than text-message codes
- [ ] Require it for your own employees too, especially those who work in vendor systems
Passwords
- [ ] Give your team a password manager such as 1Password or Bitwarden
- [ ] Encourage your vendors to use one as well
- [ ] End shared logins, so every person has their own
- [ ] Change credentials when people at a vendor change
DNS filtering
- [ ] Use DNS filtering to block known bad domains
- [ ] It helps when a tampered software update tries to contact an attacker’s server
- [ ] Apply it to every device, including those used from home
Software updates and components
- [ ] Check that software updates are signed before installing them
- [ ] Use a software bill of materials (SBOM) to track what your critical software is built from
- [ ] Watch for flaws in third-party libraries and components (tools such as Dependabot or Renovate can automate this)
- [ ] Try vendor updates on a test machine before they reach the computers the business depends on
- [ ] Know what is installed on each computer. Windows Update never touches third-party software, so programs from other vendors need their own routine
Network segmentation
- [ ] Give each vendor access only to the systems and data it needs
- [ ] Separate your network so that a vendor connection cannot reach your most sensitive systems
- [ ] Watch traffic on vendor connections for anything unusual
Plan for a supplier going down
Availability matters here as much as secrecy. If a vendor you depend on is hit, the question is how long your own work stops.
- [ ] Write an incident plan that covers a supplier being compromised or offline
- [ ] Set out who does what on your team, at your vendors, and at your partners
- [ ] Include steps for containment, investigation, recovery, and communication
- [ ] Rehearse it in a tabletop exercise at least once a year
- [ ] Keep current contact details for each vendor’s security team
For federal contractors: protecting CUI
If you handle Controlled Unclassified Information:
- [ ] Line up your supply chain practices with NIST SP 800-171 and CMMC requirements
- [ ] Require vendors that handle CUI to meet the same standards
- [ ] Write down your supply chain risk procedures for assessment
- [ ] Put CUI handling requirements in vendor contracts
- [ ] Report supply chain incidents involving CUI as DFARS requires
Where you stand
Your customer’s questionnaire will ask about most of the items above. One question catches people: what software is on your computers, and is it current? Before you look, guess how many programs are on one of your machines and write it down. Then count.
Count What’s on Your Computers → See how many programs each Windows PC has, how many are current, and how many need updating. No credit card needed. The scan is on us. If you want step-by-step instructions afterward, that’s a paid report, and you’ll see the price before you decide.
If more programs need updating than you expected, you are in good company. You don’t have to be able to do this. We’ll do it with you. And if you run it and never speak to us again, that’s a fine outcome.
Summary
- A supply chain attack reaches you through a vendor you trust, and your bigger customers see you as one of their vendors.
- Vet vendors before you sign, put security requirements in the contract, and keep checking.
- Two-step sign-in, DNS filtering, network segmentation, and knowing what is installed limit how far a vendor problem spreads.
- Have employees verify unexpected vendor requests by phone, especially for payments, passwords, or system access.
- Plan for a main supplier going offline, and rehearse it once a year.