How do we check a key supplier before giving it access to our systems?
Ask a few concrete questions, put the answers in the contract and limit what the supplier can reach. Before giving a supplier remote access or your data, ask how it protects its own systems (multi-factor authentication, patching, monitoring), whether it has had incidents, who on its side can reach your systems, and how it will tell you if it is breached. Write a notification duty into the contract. Then grant the least access needed, for the time needed, and remove it when the work ends. Supplier risk is real: Verizon's 2025 Data Breach Investigations Report found third-party involvement in 30 % of breaches, up from 15 %. NetSenX shows the connections a supplier's remote session makes inside your network and raises an alert if it starts moving from device to device.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.