They often treat vendor assurance as a procurement step instead of an ongoing control. In critical infrastructure, supplier patching, recovery evidence, disclosure processes and remote access boundaries all need lifecycle governance, or the organisation inherits third-party risk without the evidence needed to manage it.
Why vendor risk in critical infrastructure is a lifecycle control, not a one-time review
The common mistake is treating a supplier as “approved” once procurement has collected a questionnaire or a current assurance report. In critical infrastructure, vendor risk changes as patching, remote support, outage recovery, subcontracting and access paths change, so the control has to keep pace with the relationship rather than the contract signature.
That means the security question is not just whether the supplier looked acceptable at onboarding, but whether the organisation can still verify the supplier’s patch posture, recovery capability and access boundaries when conditions change. A one-off review can be true on day one and stale by the time it matters.
For a useful comparison point, the issue is less “did we buy a compliant vendor” and more “can we still bound the vendor’s operational and security blast radius next month, after the next emergency change, or after a subcontractor is introduced?”
What evidence security teams should demand from suppliers
Vendor assurance becomes meaningful only when it is anchored in evidence that can be refreshed. Security teams should expect proof of patch management discipline, recovery testing results, disclosure and notification workflows, and the exact conditions under which remote access is granted, monitored, and removed.
That evidence should map to the service the supplier actually provides. A fuel, power, water, or industrial operator does not need generic “security posture” statements, it needs evidence that the supplier can patch exposed systems on a defensible timeline, recover safely after disruption, and prove that privileged access is limited to the minimum operational path.
When a supplier cannot produce current evidence, the right response is not to assume the risk is low. It is to treat the gap as an unresolved control failure and decide whether the business can operate with that uncertainty, or whether access and change paths need to be constrained until the evidence is available.
For teams building a repeatable review process, the Vendor Security Assessment Template is useful because it structures questions around evidence requests, scoring and approval decisions rather than informal trust.
How to govern third-party access, recovery and disclosure
Critical infrastructure vendors often fail at the seams between security, operations and procurement. Remote access is granted for convenience, patching is deferred for availability reasons, and recovery plans assume the supplier will tell you what happened after an incident. Those seams are where the real risk lives.
A stronger model is to govern the relationship across its full lifecycle: who can access what, when access expires, how changes are approved, how patch exceptions are tracked, how recovery evidence is reviewed, and how notification obligations are triggered. That is especially important when a supplier can reach operational technology, management networks, or support tooling that can affect availability.
The practical test is whether the organisation can answer three questions at any time: what the vendor can reach, how fast the vendor can be forced to remediate, and what evidence proves the vendor can recover without creating a new incident. If those answers depend on tribal knowledge, the control is not mature enough for critical infrastructure.
The broader lifecycle view is captured well in the Third-Party Risk Management Guide, which covers vendor tiering, continuous monitoring, contract clauses and offboarding.
Risk and Threat Considerations
Vendor risk in critical infrastructure is dangerous because it combines trusted access, operational dependency and slow remediation. A supplier that is slow to patch, vague about recovery, or allowed broad remote access can become the easiest path into a high-consequence environment, even when the primary operator’s own controls are strong.
Failure mechanism: Attackers and opportunistic criminals exploit the supplier relationship, often through overbroad support access, stale credentials, weak notification discipline, or delayed remediation. Once that trust path is abused, the organisation inherits the supplier’s weaknesses as if they were its own.
Impact: The result can be service interruption, loss of visibility into compromise, delayed containment, and limited forensic evidence when the organisation needs to prove what the vendor did or failed to do. In critical infrastructure, that can quickly become an availability and safety problem, not just an IT control issue.
For critical infrastructure teams, this is why the third-party question should be framed as operational exposure, not just supplier compliance. If a vendor cannot show timely patching, bounded remote access and credible recovery evidence, the organisation should assume the relationship itself is part of the attack surface.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-5 — Account Management | Vendor access, onboarding and offboarding are central to third-party risk. |
| Recommendation — Review and remove vendor access paths on a defined schedule. | ||
| NIST SP 800-53 Rev 5 | IA-9 — Identification and Authentication (Service and Non-Organizational Users) | Third-party remote access and supplier connections need strong service authentication. |
| AC-20 — Use of External Systems | Remote vendor support and external connections are a core exposure in critical infrastructure. | |
| Recommendation — Require strong authentication for supplier-to-system access. Restrict and monitor vendor use of external access paths. | ||
| ISO/IEC 27001:2022 | A.5.19 — Information security in supplier relationships | Supplier assurance and lifecycle governance are supplier-relationship controls. |
| A.5.20 — Addressing information security within supplier agreements | Contractual terms must cover patching, disclosure and access boundaries. | |
| Recommendation — Define and maintain security requirements for supplier relationships. Embed security and reporting obligations in supplier agreements. | ||
Practitioner Guidance
What to prioritise: Start with the vendors that can directly affect operational availability, remote access, recovery workflows or safety-adjacent systems. These relationships create the largest blast radius and deserve ongoing review first.
What to verify: Confirm that the supplier can produce current evidence for patch status, restore testing, incident disclosure procedures and access revocation. If any of those are missing, treat the control as incomplete rather than inferred.
Decision rule: If the supplier’s access can reach production support or critical operations, tie renewal, exception approval and access continuation to evidence refresh, not to an annual questionnaire alone.
Practitioner takeaway: The mature posture is to manage vendor risk as a living dependency with measurable operating evidence, because in critical infrastructure the relationship itself can become the control failure.
Related resources from NHI Mgmt Group
- What do security teams get wrong about vendor risk scoring?
- What do security teams get wrong about peer-to-peer infrastructure risk?
- What do security teams get wrong about assessing vendor open source risk?
- What do security teams get wrong about supply chain obligations under critical infrastructure laws?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org