Supplier Cyber Risk: How to Protect Commercial Property

Third-party cyber risk has become one of the most significant organisational security challenges. Verizon’s 2025 DBIR found third-party involvement in 30% of breaches, double the previous year, while SecurityScorecard reported that 35.5% of all breaches and 41.4% of ransomware attacks now involve third-party access.

Commercial property operators rely on suppliers to keep buildings, technology and essential services running. From facilities management providers and security contractors to cloud vendors and building management system specialists, third parties often require physical access to sites, privileged access to systems or remote connectivity into critical environments.

That access creates supplier cyber risk.

In this article, we explain how supplier cyber risk affects commercial property and share practical steps for reducing exposure and improving resilience.

Many organisations invest heavily in securing their own networks and users, but cyber-attacks do not always begin by targeting the intended victim directly. Attackers frequently look for weaker points within a connected ecosystem, and suppliers can provide an alternative route into an organisation if appropriate controls are not in place.

For commercial property owners, managing agents, retail destinations and science parks, supplier relationships are a fundamental part of daily operations. As buildings become increasingly connected, understanding and managing supplier cyber risk has become an essential part of operational resilience.

The security of your organisation is no longer decided solely by your own cyber security controls. It is also influenced by the security of the organisations that support your estate.

Why Supplier Cyber Risk Matters to Commercial Property

Modern commercial properties depend on a broad network of suppliers, service providers and technology partners.

These often include:

• Facilities management providers
• Security contractors
• Cleaning and maintenance suppliers
• Building management system (BMS) providers
• Managed service providers
• Connectivity providers
• CCTV and access control suppliers
• Cloud service providers
• Software vendors
• Infrastructure support partners

Many of these organisations require access to buildings, systems, networks or operational technology environments.

A supplier with excessive privileges, poorly secured remote access or compromised credentials could introduce unnecessary risk to the wider estate. The greater the level of connectivity between organisations, the more important it becomes to manage third-party cyber risk effectively.

Which Suppliers Create Cyber Risk?

The level of cyber risk is not determined solely by the type of supplier. It depends on the level of access they hold and the criticality of the systems they support.

Facilities Management Providers

Facilities management organisations often support multiple buildings and client environments simultaneously.

They may have access to:

• Building operations platforms
• Maintenance management systems
• Energy management tools
• Operational reporting platforms
• Contractor management systems

A cyber incident affecting a facilities provider may have operational consequences across several customer environments at the same time.

Security Contractors

Security providers frequently manage some of the most sensitive systems within commercial properties.

These may include:

• CCTV systems
• Monitoring platforms
• Access control solutions
• Visitor management systems
• Intruder alarm services

Because these systems often require privileged access and remote administration capabilities, strong governance and access controls are essential.

Cleaning and Maintenance Contractors

Cleaning contractors are not traditionally viewed as cyber security stakeholders, yet they often have regular physical access to operational environments.

Questions worth asking include:

• Can contractors access communications rooms or plant areas?
• Are visitor procedures consistently enforced?
• Are temporary access permissions reviewed?
• Is physical access logged and monitored?

Effective cyber resilience combines both physical and digital security controls.

Building Management System Providers

Building management system providers support technologies that are increasingly connected to wider business and operational networks.

Typical systems include:

• HVAC
• Lighting controls
• Energy monitoring
• Environmental management
• Smart building technologies

Remote access arrangements are often required for maintenance and support. As a result, BMS environments have become an important part of the cyber attack surface within commercial property.

Technology Suppliers

IT providers, cloud vendors and connectivity partners can have broad access across critical business systems.

Examples include:

• Managed service providers
• Cloud providers
• VoIP suppliers
• Connectivity providers
• Software vendors
• Infrastructure support partners

A compromised technology provider may expose multiple customers simultaneously. Understanding how suppliers manage identity protection, vulnerability management and incident response is therefore essential.

How Supplier Access Can Create Risk

Over time, organisations often accumulate numerous remote access arrangements for suppliers supporting different systems.

These may include:

• VPN connections
• Remote monitoring tools
• Support portals
• Remote desktop services
• Vendor-specific management platforms

Most are established for legitimate business purposes, but they can remain active long after they are no longer required.

Property operators should regularly ask:

• Which supplier personnel currently have access?
• Is that access still required?
• Is multi-factor authentication enabled?
• Is supplier access and activity monitored?
• Are access privileges appropriate?
• Is access limited to approved systems and times?

Regular access reviews help remove unnecessary exposure and strengthen governance.

How to Assess Supplier Cyber Risk

A structured supplier assurance process can significantly reduce cyber risk.

A practical approach includes:

1. Identifying all suppliers with physical, network, system or data access.
2. Recording which systems, buildings and environments they can access.
3. Classifying suppliers according to operational importance and risk.
4. Reviewing the supplier’s security controls and certifications.
5. Identifying any gaps or weaknesses.
6. Reassessing suppliers during contract renewal and following significant changes.

The objective is to identify and address supplier-related risks before they become incidents.

Seven Ways to Reduce Supplier Cyber Risk

1. Establish a Supplier Assurance Programme

Cyber security should be integrated into supplier onboarding, management and renewal processes.

Areas to assess may include:

• Security policies
• Incident response capability
• Access management controls
• Vulnerability management practices
• Security certifications

A supplier assurance programme helps organisations understand risk before problems arise..

2. Set Minimum Security Requirements

Not every supplier requires the same level of scrutiny. However, organisations should define baseline security expectations for suppliers with access to critical systems or sensitive data.

Requirements may include:

• Multi-factor authentication
• Secure remote access
• Patch management processes
• Privileged access controls
• Incident reporting procedures

3. Require Cyber Essentials Where Appropriate

Cyber Essentials provides a recognised, government-backed baseline of protection against common cyber threats.

Requiring suppliers with access to important systems or information to maintain Cyber Essentials certification can help establish a consistent minimum standard across the supply chain.

Certification should form part of a wider supplier assurance programme rather than being viewed as a complete security assessment.

4. Conduct Regular Access Reviews

Supplier access should never be assumed to remain appropriate indefinitely.

Reviews should confirm:

• Who has access
• What they can access
• Why access remains necessary
• Whether permissions remain appropriate

Removing unnecessary privileges reduces the potential impact of compromised accounts.

5. Enforce Strong Access Controls

Supplier access should:

• Require multi-factor authentication
• Use individually assigned accounts
• Follow least-privilege principles
• Be monitored and logged
• Expire when no longer needed

Strong identity management remains one of the most effective ways to reduce cyber risk.

6. Segment Critical Systems

Network segmentation helps reduce opportunities for threats to move between different parts of an organisation.

Consider separating:

• Corporate IT environments
• Operational technology networks
• Building management systems
• CCTV systems
• Tenant environments
• Supplier access zones

Segmentation can significantly reduce the impact of compromised supplier credentials or devices.

7. Include Security Requirements in Contracts

Cyber security expectations should be clearly documented within supplier agreements.

Areas commonly covered include:

• Incident notification requirements
• Security control obligations
• Access management standards
• Data protection requirements
• Compliance obligations
• Audit rights
• Supplier offboarding procedures

Clearly defined contractual obligations improve accountability and support stronger governance.