Your provider has passed the evaluation. They’ve signed the contract, submitted their documentation, and designated a contact person for issues. But do you know who they rely on to provide the service to you?
In just ten days in October, two very different incidents showed why that question matters. One involved a software component used in web services. The other affected the refrigeration systems in French supermarkets. They don’t necessarily share a technical cause. They share a management lesson: a dependency you barely notice can bring a business you know very well to a halt.
When the Incident Ends Up in the Trash
On the night of October 11–12, a cyberattack disrupted the operation of the refrigeration systems at hundreds of French supermarkets. Several chains confirmed that they had to discard fresh and frozen products. The damage went beyond the screens and affected the merchandise directly.
CERT-FR confirmed numerous vulnerabilities in Danfoss controllers from the AK-SM and AK-SC series, as well as in Copeland XWEB and Dixell XWEB systems. Its recommendations included removing management interfaces exposed to the internet, reviewing configurations, and re-establishing access via a secure VPN or a protected network. To understand the risk, it is important to look at the entire chain: the supermarket needs refrigeration; a specialist installs or maintains the equipment; a manufacturer supplies the controllers; and software enables remote monitoring.
Each relationship may seem reasonable on its own. The problem arises when no one has a sufficient overview of the whole picture. Who checks how remote access is handled? Who verifies that the equipment continues to receive updates? Who decides when to replace it? Who is responsible if an insecure configuration puts the merchandise at risk?
These questions should be part of the contracting process and service monitoring.
Nine days later, the alert was buried deep within the app
On October 21, PHP released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619. The flaws could allow remote code execution without authentication.
An organization might know the name of its application or its hosting provider but still be unaware of whether the service used PHP or which version was installed.
For this reason, the joint advisory from European authorities called for identifying PHP-based applications, coordinating with hosting and service providers, and applying updates, prioritizing systems exposed to the internet. The instruction seems straightforward. Implementing it requires information that should have been available before the alert was issued.
The urgency of updating does not require us to exaggerate the damage.
The risk doesn’t end when the contract ends
These two cases illustrate three recurring problems in third-party management.
The direct supplier is just the beginning. Behind the contracted service are manufacturers, components, subcontractors, and infrastructure. Not all require the same level of oversight, but the dependencies that support critical processes deserve attention.
The impact could be far-reaching. The assessment must consider what happens if the service stops working, if equipment is tampered with, or if a facility must be shut down. Data loss is one possibility; business disruption is another.
The first question requires some preliminary work. When an alert comes in, we need to know whether it affects us, who should verify it, and what action to take. If that answer depends on piecing together the chain of events through phone calls and emails, we’ll start handling the incident too late.
We don’t need to know every component from every vendor. We need to decide which dependencies are relevant and maintain sufficient information about them.
Standardizing during the contracting process is just the beginning
A vendor may pass the initial evaluation and then later change its infrastructure, bring in a subcontractor, or continue using equipment that is no longer supported.
That’s why approval should trigger a monitoring process.
A third-party evaluation program should allow for:
- Prioritize by criticality. Identify which suppliers support essential activities and what the consequences of their disruption would be.
- Inquire about relevant dependencies. Identify the technologies, manufacturers, and subcontractors that could affect service continuity.
- Evaluate specific controls. Patch management, remote access protection, maintenance, continuity, and incident response.
- Request evidence commensurate with the risk. Certifications, technical documentation, and relevant reports, reviewing their scope and validity.
- Update the assessment. Establish periodic reviews and ad hoc reviews when the service changes or a relevant alert is issued.
- Agree on responsibilities. Define points of contact, communication deadlines, and obligations to collaborate in the event of an incident.
A questionnaire helps gather information. Its value depends on the questions, the evidence, and the decisions made based on the responses.
Where Ithikios’ Third Party Manager Fits In
Managing this process with emails, spreadsheets, and shared folders means spending time chasing down responses, locating documents, and verifying which information is still current.
Ithikios’ Third Party Manager allows you to centralize and automate third-party approval, evaluation, and document management processes. The module offers customizable forms, periodic evaluations, expiration and update management, notifications, and auditable process traceability. It is integrated into the Ithikios Trust Center.
When applied to the scenarios described above, this approach allows us to organize the collection and review of information that we will later need to take action. For example, we can ask a hosting provider what procedure it follows in the event of a critical vulnerability, how it confirms that an update has been applied, and who communicates the status to customers.
We can ask a refrigeration maintenance company for information about the installed equipment, its support structure, remote access conditions, and responsibilities for updates. The assessment must be tailored to the service. The consequences of an inadequate response must also be taken into account.
Third Party Manager makes it easier to consistently request, review, and keep that information up to date. Identifying dependencies requires the organization to ask the right questions and the supplier to provide reliable answers.
A platform does not eliminate that responsibility. It helps the organization fulfill it in an orderly, consistent, and evidence-based manner.
The Limits of the Tool and the Value of the Process
No compliance tool can prevent a vulnerability in PHP from being discovered. Nor does it replace a security update, proper configuration, or remote access protection.
What it can improve is our ability to anticipate avoidable exposures and respond when a problem arises.
Having a registered vendor is of little use if we don’t know what processes they follow. Having a certification on file provides limited information if we haven’t verified what it covers. And having a contact person is of even less help if no one has agreed on what they should communicate during a crisis.
Technology adds value when it supports a management process that works.
Three Questions Before the Next Alert
The next news story could affect a software library, a cloud service, or the equipment that maintains the temperature in a warehouse.
Before it arrives, it’s a good idea to answer:
- Which vendors could disrupt a critical business activity?
- What do we know about the relevant third-party providers they use to deliver the service to us?
- Who would confirm whether we are affected, and based on what information?
If it’s difficult to answer that question today, there’s a specific area for improvement that needs to be addressed.
Your supplier’s supplier may fall outside the scope of your direct contract. The consequences of an incident can affect your bottom line.
With Ithikios’ Third Party Manager, you can streamline the approval, evaluation, and monitoring of your third parties. Learn about the module and request a demo.
*Article enhanced with AI.
