April 23rd, 2021 • Jackie Risley • Reading Time: 4 minutes

Supplier collaboration means treating key suppliers as partners—sharing information, planning jointly, and building resilience together—rather than managing them purely transactionally.

For some organizations, managing suppliers has historically been fairly transactional. Have they provided documentation needed for onboarding? Do they fulfill their contractual obligations? Should we renew this contract? However, the National Institute of Standards and Technology (NIST) notes that “[i]ncreasingly, organizations are treating their suppliers as members of their ecosystem and closely collaborating in a variety of ways.”

In its recently published Key Practices in Cyber Supply Chain Risk Management report, NIST advises that best-practice organizations “Closely Collaborate with Key Suppliers” within their cyber supply chain risk management (C-SCRM) programs. This blog is part of a series, which explores how technology investments can support successful implementation of NIST’s Key Practices.

In its Key Practices in Cyber Supply Chain Risk Management report, NIST advises that best-practice organizations “Closely Collaborate with Key Suppliers” within their cyber supply chain risk management (C-SCRM) programs. This blog is part of a series, which explores how technology investments can support successful implementation of NIST’s Key Practices.

Shifting Supplier Relationships

The global pandemic drove home the risks associated with reliance on suppliers and the interconnectedness of the global supply chain. As organizations recognized that the resilience of their suppliers was critical to their own, many organizations shifted to a more collaborative approach.

In regulated industries, those deemed essential services needed to ensure that their critical suppliers could continue operations. But even in non-essential businesses, buyers began to take a more collaborative approach to risk, such as renegotiating payment terms in order to help a critical supplier maintain operations.

How Technology Can Support Supplier Collaboration

The frequent visits, more formal meetings, and frequent communication recommended by NIST to build strong collaborative relationships take time and resources. Unfortunately, those are in short supply in many C-SCRM programs. While technology is often viewed as a barrier to more personal interactions, it has the potential to empower supplier collaboration when it includes:

• Intelligent automation to reduce time spent on low-value tasks. Too many programs rely on manual processes to manage activities across the supplier lifecycle. Capabilities such as workflow and AI/machine learning can free up employees to focus on supplier collaboration.
• Robust reporting to understand which suppliers should be prioritized, track activities and status, and provide visibility to senior management. In a survey, a mere 20% of respondents indicated that they could quickly and confidently report on the most basic data point: what third parties they have. That suggests that most organizations are spending far too much time chasing down data, rather than building supplier relationships.
• The ability to conduct business impact assessments (BIAs) that proactively identify challenges facing suppliers during adverse events (e.g. weather, biohazards, etc.). BIAs provide an opportunity to partner with suppliers to anticipate or prevent disruptions and keep them from affecting the business relationship (e.g. renegotiating contractual delivery dates).
• Automated remediation processes that facilitate an interactive, non-punitive approach to addressing any issues and corrective actions. This ensure that clear expectations are communicated and fulfilled while creating a robust audit trail.
• Opportunities for mentoring and training suppliers, as recommended by NIST, so that they can understand and continue to improve best practices. These can include embedded guidance within the product, integration with learning management (LMS systems) to provide training, and education resources through peer interactions/round tables and industry events.
• Easily accessible communication channels between the buyer and the supplier to complement formal interactions. These can include features such as threaded comments as part of the assessment process and a feature-rich supplier portal to manage communications in addition to methods such as email.

The NIST guidance include a total of 8 Key Practices, which are explored in this blog series. The complete list includes:

1. Integrate C-SCRM Across the Organization
2. Establish a Formal C-SCRM Program
3. Know and Manage Critical Suppliers
4. Understand the Organization’s Supply Chain
5. Closely Collaborate with Key Suppliers
6. Include Key Suppliers in Resilience and Improvement Activities
7. Assess and Monitor Throughout the Supplier Relationship
8. Plan for the Full Life Cycle

Frequently Asked Questions

What does NIST recommend for improving supplier relationships in cyber supply chain risk management?

NIST advises organizations to closely collaborate with key suppliers, treating them as integral members of their operational ecosystem. This collaborative approach moves beyond transactional interactions, focusing on mutual resilience and shared understanding of risks within the cyber supply chain.

Why did the global pandemic highlight the importance of supplier collaboration?

The global pandemic underscored the critical interconnectedness of supply chains and the vital role of supplier resilience for an organization’s own continuity. Many businesses shifted towards more collaborative approaches, recognizing that supporting critical suppliers, such as renegotiating payment terms, was essential for maintaining operations.

How can automation technology enhance collaboration with key suppliers in C-SCRM?

Automation technology, including workflows and AI/machine learning, reduces time spent on low-value tasks, freeing staff to focus on strategic supplier collaboration. This also supports robust reporting for prioritization, proactive business impact assessments, and automated remediation, streamlining interactions and improving efficiency across the supplier lifecycle.

What is a business impact assessment (BIA) and how does it help manage supplier risks?

A business impact assessment (BIA) proactively identifies potential challenges suppliers face during adverse events, like natural disasters or biohazards. BIAs enable organizations to partner with suppliers to anticipate or prevent disruptions, such as renegotiating delivery dates, ensuring business continuity and strengthening the relationship.

How can organizations provide training and mentoring to improve supplier best practices?

Organizations can offer training and mentoring through embedded guidance within products, integration with learning management systems (LMS), and educational resources via peer interactions or industry events. This helps suppliers understand and continuously improve their adherence to best practices, enhancing overall supply chain security.

What are common challenges when implementing close collaboration with C-SCRM suppliers?

Implementing close collaboration can be challenging due to resource constraints, especially time and staffing for frequent interactions. Organizations may also struggle with immature manual processes, insufficient data visibility to prioritize suppliers, and resistance to moving beyond traditional transactional relationships, hindering effective partnership development.

What are the other key practices in NIST’s cyber supply chain risk management framework?

Beyond collaborating with key suppliers, NIST’s framework includes integrating C-SCRM across the organization, establishing a formal C-SCRM program, knowing and managing critical suppliers, understanding the organization’s supply chain, including key suppliers in resilience activities, assessing and monitoring relationships, and planning for the full lifecycle.

Share with Your Friends: