Why should companies care about how their suppliers work with data?

Digitalization has accelerated business. But it has also dramatically expanded the risk map. Today, most companies no longer run key processes only "in-house" - ERP runs in the cloud, the warehouse is managed by an external WMS, accounting is connected to SaaS tools, HR data is managed by a specialized system, and communication takes place via other platforms.

So the question has long been: Is our data secure within the company?

Another one is much more important: Do we know how they are managed at all of our external suppliers?

And it is precisely in the answer that the difference between companies that treat security as a formality and those that manage it strategically begins to become apparent.

Every SaaS vendor holds a portion of your responsibility

A modern company routinely works with dozens of external systems – ERP, WMS, EDI solutions, accounting and tax tools, HR and payroll systems, CRM, reporting tools, or integration platforms.

Each of them contains sensitive data ranging from business information to personal data and financial reports to manufacturing know-how.

When choosing a supplier, company management naturally focuses on functionality, price, implementation and support. However, much less attention is paid to the following questions:

• How does the supplier work with data?
• How does it manage security?
• How prepared is he for the incident?
• What risks does it transfer to us?

These are key questions that you need to (start) asking yourself. Regulations such as GDPR , NIS2 , or the Cybersecurity Act clearly state one thing: Responsibility does not end with the signing of a contract.

Minimum vs. active safety management

There are two types of suppliers on the market today.

Those who meet the minimum

• They have basic contractual documentation.
• They only respond to security when it is required.
• They address security rather reactively.
• Internal processes are not systematically auditable.

Formally, everything may be "okay". However, in the long term and strategically, these are risky suppliers.

Those who actively manage security

For these suppliers, like us at GRiT , it's not just about complying with mandatory regulations, but about a systematic and proactive solution to security.

• They have clearly defined security processes.
• Performs regular monitoring and logging.
• They undergo penetration testing.
• There is access control and data segmentation.
• They have a business continuity plan (BCP/DR).
• Conducts internal employee training.
• They have certified management systems (e.g. ISO 27001).

The difference between these two supply approaches is often not apparent in everyday operations.
However, in a crisis situation, it becomes immediately clear who is just making declarations and who is really ready to solve things.

Five questions every CEO, CIO or COO should ask themselves

If your company uses external IT and SaaS solutions, answer the following:

1. Who holds all our key data?
   Do we have a list of them? Do we know where they are physically and technologically stored?
   
   
2. Do we have an overview of their security framework?
   Or just a general assurance in the contract?
   
   
3. Does our supplier have a security management system in place (e.g. ISO 27001 )?
   And is the certification really actively managed, or just formal?
   
   
4. How often is security testing performed?
   Penetration tests? Internal audits? Access audits?
   
   
5. What is the preparedness for an incident?
   Is there a clear plan? Who communicates? Within what timeframes?

If you don't have a clear answer to any of these questions, it's a signal that third-party management may be the weakest link in your security.

Safety as a supplier selection criterion

It is important to note that regulations (e.g. NIS2 ) and other legislation significantly expand management responsibilities when it comes to data security. Companies will need to demonstrate supplier risk management, assess third parties, document security measures, and ensure oversight of critical services.

This means one thing – supplier security becomes part of your own compliance. In practice, this means a necessary change in mindset.

Just as you assess a partner's financial stability or the quality of their solution, security should be part of the selection process, regular evaluation, and long-term cooperation.

Certification (e.g. ISO 27001 ), transparent processes, open communication about risks and clear responsibilities – these are no longer “nice to haves”. They are a competitive advantage, if not a necessity.

What should a responsible supplier look like?

A responsible and security-enlightened partner:

• understands that he/she is working with key client data,
• has security anchored at management level,
• regularly tests and evaluates risks,
• invests in prevention, not until incident resolution
• and is able to document its processes and measures.

At GRiT , we see security as a seemingly invisible but essential layer of our solutions. It's not just about technology. It's about processes, governance, accountability, and long-term trust.

That's why security is an integral part of how we design, operate, and develop our systems.

Final question

How many third parties are working with your data today?
And how many of them do you actually know how to protect them?

Digital transformation has brought speed and efficiency. Now it's time for it to bring conscious risk management. Because the security of your data doesn't start with a firewall. It starts with choosing a partner.

‍

And if you want to check how to approach partner security, download our E-book: A Management Framework for Secure Decision-Making in Digital Collaboration.