Supplier and IT provider security: the risks and the questions small businesses ask

Supplier cyber security risk is the chance that a problem at a business you rely on, such as an IT provider, software service or regular supplier, becomes a problem for your business. ASD’s small business guide describes understanding your supply chain because “security issues with these services or providers could have a significant impact to your business”. This guide explains where supplier and IT provider risk comes from, the questions official guidance describes asking, how provider access is commonly managed, and how payment detail changes fit in. It’s general education, not a supplier assessment or legal advice.

Why it matters

Small businesses rarely run everything themselves. Email, accounting, the website, payments and IT support are often provided by someone else. ASD’s small business guide even describes “using online or cloud services that offer built-in security, instead of managing your own”. That’s often a sensible trade-off, but it means a business depends on how well those providers protect their own systems.

Supplier risk usually shows up in three ways:

1. A provider with access to your systems. ASD’s publication on managed service providers (MSPs) notes that they “often have privileged access to systems”, especially when managing them remotely. If the provider’s own accounts are compromised, that access can be misused.
2. A provider that holds your data. ASD’s 2026 guidance on AI-enabled attacks for small businesses describes reviewing “which companies you use to store and share your customer data and other sensitive data”.
3. A supplier whose email is used against you. ASD’s small business guide warns that “criminals can impersonate business representatives by using compromised email accounts”, and includes a case study where a supplier found “one of their email accounts had been hacked and was sending out fraudulent bank account details”.

Questions ASD describes asking IT providers

ASD’s Questions to ask managed service providers sets out five headline questions:

1. “Are you implementing better practice cybersecurity?”
2. “Are you securely administering your systems and services?”
3. “Are you monitoring activity on your systems and services?”
4. “Are you regularly assessing your systems and services?”
5. “Are you prepared for, and able to respond to, cybersecurity incidents?”

The publication points to the Essential Eight as a way providers can show better practice (see the Essential Eight explained). It also says that “experiencing a cybersecurity incident is not a question of if but when”, and that “actively reporting cybersecurity incidents can assist in the early and effective management” of them.

What those questions are about, in plain English

ASD’s publication doesn’t list sub-questions. The questions below are our plain-English explanation of what each heading is about, not an official checklist:

• Better practice: Does the provider follow a recognised framework such as the Essential Eight?
• Secure administration: How do the provider’s staff sign in to our systems? Do they use MFA and separate admin accounts?
• Monitoring: Does the provider watch for unusual activity, and would they tell us?
• Assessing: How does the provider find and fix vulnerabilities in the systems they manage?
• Incident response: If something goes wrong, who contacts us, how quickly, and what happens next?

Questions for website and data providers

ASD’s guidance on AI-enabled attacks describes identifying the person or service provider responsible for website security and asking:

• whether the software is vendor-supported with ongoing security fixes, and if not, whether it can be replaced
• whether security fixes are applied automatically, or quickly after release
• how quickly they would detect a breach and notify the business, and whether they can remove the attacker and restore from a recent clean backup.

It also describes taking down websites that are no longer needed and switching off unnecessary features on the ones that remain.

How to manage provider access

ASD’s small business guide describes making sure “each user can access only what they need for their role”, limiting and securing shared accounts, and securing administrative accounts “with a strong passphrase or multi-factor authentication”. Those principles apply to outside providers too.

Microsoft’s guidance for its own cloud services describes the same idea as least privilege: granting administrators “exactly the permission they need to do their job”, and regularly reviewing who has admin access because people “can amass unnecessary access over time”. The admin roles and least privilege guide covers this for Microsoft 365.

Common practices for provider access, drawn from those principles:

• Named accounts, not shared ones. Each provider technician has their own sign-in, so activity can be traced and access removed individually.
• Only the access needed. A provider that manages email may not need access to accounting or banking.
• MFA on provider accounts, in line with ASD’s guidance to turn on MFA “wherever possible”.
• The business keeps ownership. The business itself, not only the provider, holds an admin account for key services such as email and the domain name (see securing small business cloud accounts).
• A record of who has access. A short list of which providers can access which systems.
• Removing access at the end. ASD’s guide notes that, unless passwords are changed, people can keep accessing accounts after they leave. The same applies when a provider relationship ends.

The shared responsibility model explains which parts of security a cloud provider handles and which stay with the customer.

Payment detail changes from suppliers

One of the most common supplier-related risks is a fake request to change bank details. Scamwatch advises people to “stop and check any changes to payee information on invoices” and to contact the business “by phone using a number you have sourced independently”. A 2018 Scamwatch alert said businesses shouldn’t check changes “just by return email or using other contact details provided”, and suggested they “consider a multi-person approval process for transactions over a certain dollar threshold”.

Scamwatch also notes scammers may add “one extra letter or number to the email address”. The payment redirection controls guide explains these checks in detail, and business email compromise explains how the scam works.

ASIC’s guidance for scammed businesses also describes the other direction: warning staff, clients and suppliers to look out for suspicious activity, such as “requests to change bank details or for large transfers”, if a business is impersonated.

A fictional example

Sam owns a small café. An outside IT provider (support@it-provider.example) set up the café’s email and point-of-sale system two years ago. Sam realises the provider’s former technician still has an admin login, and that only the provider knows the domain name password. Using ASD’s five questions as a guide, Sam asks the provider how its staff sign in, whether it uses MFA, and who would contact the café after an incident. Sam’s own admin account is added, the old technician’s login is removed, and the café keeps a one-line list of who has access to what.

Things to watch for

• Providers with more access than they need, or access that stays after the work is finished.
• Losing control of key accounts. If only the provider can sign in to the domain registrar or email admin centre, the business may struggle if the relationship ends.
• Bank detail changes by email, even from an address that looks right. Scamwatch’s guidance is to contact the business by phone “using a number you have sourced independently”.
• Assuming a provider handles everything. Contracts and service terms vary; what’s included is a question for the provider and, where needed, a legal adviser.
• Forgotten services. Old websites, trial accounts and integrations can hold data long after anyone uses them. ASD’s 2026 guidance describes turning off websites no longer needed.

Common questions

How can I protect my business from supplier and IT provider cyber risks?

Official guidance starts with knowing which providers the business relies on. ASD’s small business guide describes understanding your supply chain because “security issues with these services or providers could have a significant impact to your business”. Supplier risk usually shows up as a provider with access to your systems, a provider that holds your data, or a supplier whose email is used against you. See why it matters and how to manage provider access.

What questions do I ask my IT provider about cyber security?

ASD’s Questions to ask managed service providers sets out five: whether they’re implementing better practice cybersecurity, securely administering systems and services, monitoring activity, regularly assessing their systems, and prepared for and able to respond to incidents. The publication points to the Essential Eight as a way providers can show better practice. See questions ASD describes asking IT providers for the exact wording and a plain-English explanation.

Why are managed service providers a cyber security risk?

ASD notes that managed service providers “often have privileged access to systems”, especially for remote management. If a provider’s accounts are compromised, that access could affect its customers. ASD’s publication also says that “experiencing a cybersecurity incident is not a question of if but when”. See why it matters.

How do I manage IT provider access to my business systems?

ASD’s small business guide describes giving each user only the access their role needs and securing admin accounts with MFA or strong passphrases. Applied to providers, common practices include named accounts rather than shared ones, only the access needed, MFA on provider accounts, the business keeping its own admin account, and removing access when the work ends. See how to manage provider access.

What do I do if a supplier asks to change bank details?

Scamwatch’s guidance is to “stop and check any changes to payee information on invoices”, and to contact the supplier by phone “using a number you have sourced independently”, not details in the email. A 2018 Scamwatch alert also suggested multi-person approval for larger payments. See payment detail changes from suppliers and the payment redirection controls guide.

What do I ask my website provider about security?

ASD’s guidance on AI-enabled attacks describes asking whether the website software is vendor-supported with ongoing security fixes, whether fixes are applied automatically or quickly after release, and how quickly the provider would detect a breach, notify the business and restore from a recent clean backup. It also describes taking down websites that are no longer needed. See questions for website and data providers.

Where to get official help

• ASD: Questions to ask managed service providers
• ASD’s small business cyber security guide
• business.gov.au cyber security checklist, which notes businesses can contact non-government IT service providers or cyber security professionals and lists the Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371).
• If a payment has gone to the wrong account, ASIC’s guide what to do if your business has been scammed sets out the official steps.