Supply chain: How can we build an environment of trust?

According to a Verizon report, 30% of data breaches occurring in 2025 involved a third party. When a trusted third party falls victim to a cyberattack, your company’s level of cybersecurity becomes irrelevant: your sensitive data may still be compromised.

Your cybersecurity strategy must therefore extend beyond the boundaries of your organisation. It should also encompass the entire supply chain. Certain regulations, such as the NIS2 Directive, require companies to integrate risks linked to service providers and suppliers into their security policies. Here are some best practices for building a trusted environment with your partners.

Precautions to take before starting the collaboration

The selection of your service providers must take your security requirements into account. If you choose a collaboration solution, it must guarantee end-to-end encryption of your data. If you intend to host sensitive information, it is important to favour a provider certified under the SecNumCloud scheme.

These issues should be openly discussed with your future partner. The security of your collaboration cannot rely solely on trust. It is essential to formalise the third party’s security obligations contractually. For example, you may require a confidentiality clause, reiterate the obligation to notify incidents, provide for audit rights, or establish a list of personnel authorised to access your systems. Compliance with regulations such as the GDPR, the Cybersecurity Act, or NIS2 may also be included in the contract.

According to the latest CESIN barometer, 85% of companies have incorporated security clauses into their contracts with service providers. However, contractual commitments alone are no longer sufficient. You must assess your partners’ security level. This assessment may be carried out through security questionnaires. It is advisable to go further by conducting a security audit of the partner to ensure they are not exposed to significant vulnerabilities. Service providers holding recognised certifications such as ISO 27001 or SOC 2 generally demonstrate a high level of cyber maturity.

Securing exchanges during the collaboration

Exchanges with your partner must remain secure throughout the collaboration. When two companies use different communication and collaboration tools, the multiplication of channels becomes a risk factor. Not all solutions provide the same level of encryption robustness, nor the same guarantees regarding the location and sovereignty of hosted data.

It is therefore essential to adopt sovereign and secure communication tools to protect the confidentiality of your data. Citadel Team is a sovereign and secure communication solution that ensures end-to-end encryption of your messages and calls, while also protecting audio conversations and video conferences, including those involving external stakeholders. Similarly, Cryptobox provides a secure file-sharing space accessible to your partners, classified at the “Restricted Distribution” level.

Beyond the tools themselves, communication must be fully transparent. For instance, your partner should inform you of any changes made to their infrastructure or personnel changes involving individuals who have access to your data. Another essential requirement is ensuring the traceability of access and actions performed on your data and environment.

Anticipating Security Incidents

Do not be caught unprepared in the event of a security incident affecting a third party. The resilience of your digital supply chain must be prepared in advance. Regularly test your environment by organising intrusion and cyberattack simulations. These crisis exercises should be conducted jointly with your critical service providers. The aim is to identify existing vulnerabilities in order to correct them and continuously improve, while also strengthening coordination and efficiency during emergency situations.

To reduce the impact of a security incident, it is also important to develop a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) with the partner. These plans should define the role of each stakeholder, the crisis communication tools to be used, and the steps to follow to protect business operations.

Human error is often the root cause of security incidents. Training helps to reduce this level of risk. Your service providers should therefore be included in awareness programmes in order to establish a shared culture of cybersecurity.

Finally, every incident even a minor one provides valuable lessons. To achieve this, incidents should feed into a shared register of security events and corrective actions undertaken. This strengthens the level of security for both companies and helps build a long-term partner relationship.

The supply chain is a particularly attractive attack vector for cybercriminals. They target partners with weak levels of protection in order to gain access to your data or launch lateral attacks. To counter these threats, it is essential to build a trusted environment with third parties. Select partners whose cyber maturity matches your requirements, and secure day-to-day exchanges with sovereign and secure tools such as Citadel Team for messages, calls, audio conversations and video conferences, and Cryptobox for file sharing.