Stop Drowning in Lake Assurance: Supply Chain Security and a New Frontier

## Overview

Fiona Long, CEO and founder of InfoSecAssure, presents a comprehensive examination of supply chain security challenges, focusing particularly on the proliferation and ineffectiveness of security questionnaires. With 25 years in information security—including 15 years in banking, cybercrime investigation, and risk assessments—Long frames supply chain risk management as a critical yet poorly executed practice that drowns organizations in excessive questionnaires without delivering meaningful assurance.

## The Supply Chain Risk Problem

Long begins by establishing why supply chain risk matters, citing real incidents including a 40-million-credit-card theft through an HVAC supplier breach, COVID-era attempts to steal pharmaceutical production sequences, and a gas company ransomware attack that exposed VPN passwords. She distinguishes between supply chain risk (exposures and vulnerabilities in products/services) and cyber supply chain risk (lack of visibility and control in technology development and delivery). The focus of her talk centers on cybersecurity supply chain risk management—identifying, assessing, and mitigating risks associated with suppliers.

## Know Your Supplier (KYS) Program

Long recommends implementing a Know Your Supplier program as foundational to risk management, similar to Know Your Customer programs used for anti-money laundering. This should document supplier profiles including business context, users and data types they'll access, technology context, support models, location, and stakeholder relationships. This early assessment enables risk-informed decisions about appropriate governance rather than premature in-depth risk assessments.

## Security Contracting Strategy

Drawing from hundreds of supplier contracts she has negotiated, Long presents a tiered approach to security clauses based on supplier risk profiles. Core managed service providers warrant robust controls, while temporary service providers or software vendors need narrower, practical requirements. She emphasizes negotiating outcomes rather than prescribing how suppliers implement controls. Real-world examples illustrate power dynamics: large tech companies often impose non-negotiable standard clauses, while smaller suppliers struggle to articulate their existing security capabilities. Critical contract considerations include: use of fourth parties, geographic data location, and encryption/backup offerings.

## The Questionnaire Crisis

Long identifies security questionnaires as the industry's most problematic assurance mechanism. Her research analyzing 7,000 questionnaire questions found significant inconsistencies: government organizations prioritize physical security, banks focus on identity and access management, and law firms emphasize corporate governance—despite all using similar frameworks. Questionnaires range from 272 to 1,200 questions, and one breached company received 4,500 questions within five weeks. User access reviews alone were asked 104 different ways.

Questionnaire responses are inherently unreliable. Long provides a case study where a supplier answered detailed questions affirmatively about surveillance, access controls, and user reviews, but a subsequent audit revealed failed access reviews and controls that existed on paper but weren't operating. Most critically, questionnaires incentivize dishonesty: suppliers fear losing contracts if they reveal weaknesses, creating marketing-focused responses rather than honest assessments.

## Standards and Frameworks

Long references multiple frameworks: Australia's PSPF (Protective Security Policy Framework) with 16 core practice areas, the ISM (Information Security Manual) with 1,000 controls, the Essential Eight, NIST, ISO 27001, SOC 2 Type 2, and iRAP Assessments. She notes that SOC 2 Type 2 auditor requirements ironically include 15 years of tax experience, questioning the relevance of such certifications.

## Recommendations

Long advocates for risk-based approaches emphasizing "less is more" in governance. Rather than comprehensive questionnaires, organizations should identify the most critical controls for their specific risk context and measure those consistently. She emphasizes building trusted relationships where suppliers can openly discuss both capabilities and gaps without fear of contract loss. She recommends a two-way governance model where suppliers proactively share their security assessments rather than responding reactively to inbound questionnaires. For large organizations working with smaller suppliers, she advocates leaning in to help remediate gaps rather than simply excluding vendors.

## Takeaways

Effective supply chain risk management requires knowing suppliers deeply, creating risk-based categories, implementing fair security clauses, measuring key controls over time, and building trusted relationships where both parties can acknowledge strengths and weaknesses. The industry should move away from questionnaire-driven assurance toward supplier self-assessment and proactive security reporting.