The large company has a ransomware plan. Its supplier does not.

The large company has a security team, backups and an incident response plan. Its carrier has an accounting PC, one server, and a maintenance firm that connects to that server remotely. Which one does the attacker pick?

The chain breaks at the weakest link

Ransomware no longer targets the biggest; it targets the easiest. Dealers, subcontractors, carriers, software vendors: in most of these firms the network is flat, remote access has no second factor, and the backup lives on the same server. Encryption takes a few hours; recovery takes weeks.

For the large company this has two consequences. The first is direct: if a VPN, a shared portal or a trusted e-mail address runs from the supplier's systems into the company's, the attacker walks in through it. The second is indirect but far more common: when the supplier stops, operations stop. Shipments do not leave, delivery notes are not issued, the line waits. The company's own systems were never touched, yet that week nothing was delivered.

A document check does not measure capacity

In most organisations supplier assessment is a questionnaire: "Do you have a backup policy?", "Do you use antivirus?", "Are you ISO 27001 certified?" The supplier says yes, signs, and the form goes into a folder. Then an attack happens and it turns out that "yes" never corresponded to a restored backup.

The problem is not the questionnaire itself but what it measures. A questionnaire measures intent; what matters in the moment of attack is capacity: does the backup actually restore, does remote access actually demand a second factor, and when someone says "the servers are encrypted" at four in the morning, does everyone know what to do?

A signed questionnaire does not restore an encrypted backup.

The minimum capacity to look for in a supplier

The list is short, because expecting a security operations centre from a small firm is not realistic. Five items, each with evidence:

1. Offline or immutable backups, with restore tests at regular intervals. Evidence: the date and duration of the last test.
2. Multi-factor authentication on e-mail, VPN and every form of remote access. Evidence: a screenshot from the admin console is enough.
3. A patching routine, at least for internet-facing systems. Evidence: the last patch date.
4. Segmentation: office PCs and operational systems (warehouse, vehicle tracking, accounting) do not share the same network and the same user account.
5. A one-page incident plan: who is called, what is shut down, and when and how the customer is informed.

What the large company should do

• Tier suppliers by access and criticality. The supplier that connects to your systems, or whose outage stops your operation, should not be on the same list as the stationery supplier.
• From the top tier, ask for evidence, not signatures: a restore test report, an MFA screenshot, the incident plan itself.
• Put a notification window in the contract: within how many hours must the supplier report a security incident?
• Invite your two or three most critical suppliers to a yearly tabletop exercise. Playing "the carrier got encrypted this morning" together reveals gaps no questionnaire will ever show.

A realistic path for the small firm

If you are on the supplier side, the news is good: the five items above do not require a large budget. A managed baseline of backup, MFA, patching and basic monitoring can be set up at a predictable monthly cost. The yardstick should be this: what does a week of downtime cost you and your largest customer?

Also assume that your largest customer will start asking these questions one day. The supplier with the evidence ready moves up the list.

If you do not know which of your suppliers meets these five items, or if you are on the supplier side and "they have started asking us" is where you are, a discovery call is the right place to start.