Supplier assurance after a ransomware wave: a retailer's view

When a supplier is hit by ransomware, the retailer feels it within days: empty shelves, substituted products and customers asking questions. After a run of such incidents, many retailers have changed what they ask of their suppliers.

This article sets out the questions that have proved most useful — and the ones that only created paperwork.

The questions that helped

• Could you keep supplying us for two weeks without your main systems?
• Who would tell us, and how quickly, if you were attacked?
• Have you rehearsed restoring production systems from backup?
• Which of your own suppliers could stop you producing?

Long questionnaires rarely tell you much. A short conversation about recovery usually tells you more.