Third-party Vulnerabilities Put the Public Sector at Risk: What to Consider

Risks stemming from third-party suppliers are at the top of the threat list for public sector organizations. According to a 2024 survey of chief information security officers (CISOs)— across all 50 U.S. states and the District of Columbia—security breaches involving a third-party are one of their most pressing concerns. 

The survey highlights the need for public organizations to make strengthening third-party controls more of an imperative. This is especially important for public sector third-party supply chains, which are typically large with a complex web of dependencies. 

Public sector organizations need to know what the potential risks are for each third party as well as any changes in supplier risk throughout the lifecycle of their contract, so they can mitigate those risks before they impact critical services. This poses a significant challenge as their suppliers operate outside the bounds of their organization—and third parties are deemed more lucrative and softer targets by threat actors looking to target organizations.  

Here we explore what the third-party risks are, why they’re on the rise and key questions public sector entities should ask vendors to help mitigate risk.

More third-party exposure for the public sector than private sector

To protect their supply chains against third-party risks, public sector organizations must understand what their risks are both internal and external. It can prove to be a difficult task given factors such as transparency laws that require government agencies to publicly publish vendor contracts and expenditures. This inadvertently provides a clear roadmap for potential threat actors.

---

Any significant data breach that’s occurred for data of New Hampshire residents at the state government level…has been with a third-party partner that helps us deliver those government services.

— Ken Weeks, CISO for the state of New Hampshire in Government Technology

---

One vulnerability that should not go unnoticed or unattended is fourth-party risk that comes about by way of third-party suppliers. This happens when third-party vendors rely on other companies for services, creating additional layers of risk. For each third-party vendor in the supply chain, public sector organizations typically have indirect relationships with 60-90 times that number of fourth parties.

In the U.S., an executive order was issued to address these concerns by requiring federal agencies to enhance cybersecurity and software supply chain security. A key component of the order is the software bill of materials (SBOMs), a list of all the components that make up a piece of software including licenses and third-party dependencies. With it, organizations can reduce their third- and fourth-party risks.

Other common vulnerabilities include:

• Lack of continued oversight: While vendors may pass an organization’s initial vetting process, new risks can emerge that are undetected throughout the duration of the contract. 
• Small vendors: As public sector organizations are required to work with a multitude of small and protected suppliers, it’s crucial to understand the risks that come with these types of third parties, which may have less robust security measures, making them easy targets.

---

---

Recommendations for reducing third-party risk

While there are many ways for public sector organizations to lessen their third-party risk, the most critical requires them to continuously assess the third parties they work with. This requires organizations to focus on external threat detection in the same way that they do for their internal data systems and data via the National Institute of Standards and Technology (NIST) cybersecurity framework 2.0. 

Public sector organizations should also be sure they are asking the right questions to surface potential risks and exposure, several of which are listed below.

Ask your third-party suppliers these 6 questions

1. What data privacy and retention policies do you have in place, and what is your process for keeping them updated?
2. What are your cybersecurity policies and protocols—both for your organization and the organizations you provide services to? 
3. What, if any, security breaches has your organization experienced recently? How were you alerted to the breach? What was your response?
4. Who are the third party data sub-processors that process your customer data? And what for purposes are these organizations used?
5. How does your organization manage vulnerabilities? Do you manage the process internally or outsource it?
6. Are you able to supply proof of regular security assessments and audits?

The public sector’s reliance on third-party supply chains, while unavoidable, has created a risk that is rapidly becoming more visible, threatening the security of the sensitive information and critical services they oversee and provide. 

As cyber attacks escalate, it’s imperative that public sector entities adopt a proactive approach to managing third-party risks. Leveraging AI-powered detection solutions, prioritizing robust security measures, and fostering a culture of transparency will help organizations stay ahead of emerging threats and maintain public trust.

The stakes are high, but with the right strategies and tools, it’s possible to build a more resilient future for the public sector and those it serves.