Vendor security reviews · Commerce & industry
Vendor Security Review & Questionnaire Support for Manufacturers & Industrial IoT
A vendor security review tells a manufacturer which outside providers touching production — machine builders, integrators, ERP and IIoT SaaS vendors — actually deserve a standing connection, and which need a contract fix, a tighter access grant, or replacing. Manufacturers usually commission one after an OEM questionnaire asks who touches your systems, when an insurer's renewal raises third-party remote-access questions, or following a supply-chain entry point like the one that idled a Canadian vehicle maker's plants for weeks. We tier your vendor stack by what each one can reach and hand you a decision per vendor, not a spreadsheet of open questions.
Reviewed by the Privacy Horizon team · Last reviewed
What you're protecting
The manufacturing vendor stack under review
Each category of provider touches a different part of the plant, and the review weighs them by what they can reach rather than by the size of the invoice — a joint read between IT and the controls engineer, since neither owns the whole picture alone.
Machine builders and integrators
Vendors holding standing VPNs, Ewon and cellular gateways, or TeamViewer and AnyDesk installs on machine PCs sit in the highest-sensitivity tier, because their access reaches production equipment directly.
ERP and MES platforms
SAP, Dynamics 365, Epicor, Infor CloudSuite, Plex and similar systems hold order data, costing, HR records and increasingly customer-supplied drawings, making hosting location and sub-processor practices central to the review.
IIoT and remote-monitoring providers
Cellular gateway vendors and telemetry platforms connect sensors and machines to the outside world, often through a device IT never provisioned itself, and the review starts by finding every one that exists.
EDI and trading-partner networks
Providers such as SPS Commerce or TrueCommerce carry the order, shipment and invoice transactions your OEM relationship runs on, and a lapse there damages the trading relationship almost as directly as a plant outage would.
PLM, CAD and time-and-attendance vendors
Systems like Windchill or Teamcenter store design IP and customer-controlled drawings; time-and-attendance platforms hold employee and, at some plants, biometric data — different sensitivity, same need for a documented review.
Regulatory map
Why the law follows the data into the vendor's hands
Outsourcing a system never outsources the accountability for what happens to the data inside it. Several regimes put the responsibility for a vendor's conduct back on the plant that chose them.
Cyber Centre expectations follow the vendor connection
ITSAP.00.051's guidance on MFA, least privilege and zoning applies as much to a machine builder's remote-access account as to your own staff's. The review is how you verify a vendor actually meets that bar rather than assuming it.
PIPEDA accountability doesn't stop at the vendor's door
Handing warranty or dealer data to a processor does not transfer the responsibility for it; PIPEDA still expects comparable protection, which a documented review and matching contract terms are what evidences.
Law 25 assessment for out-of-Quebec hosting
Moving data to a US-hosted ERP or IIoT platform is a transfer outside Quebec requiring assessment under section 17 before the migration, which makes vendor review a prerequisite step rather than paperwork after the fact.
NIST SP 800-171 flows down to your suppliers too
Where CUI moves through a vendor, such as a PLM host or an engineering contractor, the control baseline you must meet extends to how that vendor handles it, and the review is where that gets checked before an assessor asks.
Controlled Goods security plans cover vendor access
A documented Controlled Goods security plan has to account for who outside your own staff can reach controlled technical data, which puts machine vendors and engineering contractors inside the plan, not only employees.
What goes wrong
How a vendor's weakness becomes the plant's problem
When a review is skipped, the failure surfaces months later as someone else's account, someone else's gateway, or someone else's sub-processor causing your outage.
The supply-chain entry point
BRP's 2022 production halt traced back to a compromised outside provider, and the RansomEXX group subsequently published stolen company files taken through that same route — the reference case for why a manufacturer's vendor review cannot stop at the ERP contract.
Standing access nobody re-examines
Machine-builder VPN accounts set up for one commissioning project often outlive it by years, unreviewed and frequently without MFA, exactly the exposure the Cyber Centre flags in its OT guidance.
Sub-processors you were never told about
Your ERP or IIoT vendor may push data through analytics, support or hosting sub-processors several layers removed from the contract you signed, each one an unexamined link in the chain holding your plant's data.
A gateway installed without IT's knowledge
Cellular and Ewon-class devices set up by a machine vendor for remote diagnostics sometimes answer to the public internet, discovered by IT only when a review goes looking for them.
Access left behind after a vendor departs
A machine builder whose contract ended years ago can still hold a live remote-access account if nobody owns the offboarding step, an orphaned connection into production that a periodic review is built to catch.
Our vendor security reviews for manufacturers & industrial iot
What the review produces for your plant
Deliverables follow our vendor security review approach — gap review, documentation guidance, control consideration and ongoing support — pointed at the providers with real access to your systems.
Vendor inventory and access map
A full list of machine builders, integrators, ERP, IIoT and EDI providers, built from contracts, invoices and a walk of the plant floor, which reliably turns up a gateway or account nobody remembered approving.
Risk tiering by what each vendor can reach
Providers ranked by production access and data sensitivity, so machine builders with standing VPNs and your ERP host sit in the deep-review tier while a low-access scheduling tool sits on a light track.
Questionnaires and evidence review
Structured questions to priority vendors, review of whatever certifications or reports they hold, and a plain finding for each one: acceptable, acceptable with fixes, needs compensating controls, or replace.
Contract gap analysis
Review of remote-access terms, breach-notice clauses, data-location commitments and offboarding obligations, with language recommendations for the next renewal or new-vendor contract.
A repeatable onboarding and review cadence
A pre-onboarding checklist for the next machine vendor or integrator, plus a lightweight annual cycle for the vendors already connected, so the review does not depend on someone remembering to run it.
How the engagement runs
How the review runs without slowing procurement
The work happens mostly on our side, with your IT manager and controls engineer supplying access lists and a plant walk rather than hosting weeks of meetings.
Step 1
Find the real vendor stack
We inventory sanctioned and unsanctioned connections using contracts, billing records and interviews with IT, the controls engineer and procurement, since the gateway nobody documented is usually the one that matters most.
Step 2
Tier, question and verify
Priority vendors receive targeted questions and their available evidence gets checked, so conclusions rest on what a vendor can actually show rather than on what their sales page claims.
Step 3
Report with a decision per vendor
Findings arrive as a verdict for each vendor with the reasoning attached, so leadership can act on the highest-risk connections first instead of reading a general risk narrative.
Step 4
Leave a process behind
We hand over the checklist, templates and review calendar, and can run the recurring cycle for you under a retainer if nobody on your team owns third-party risk today.
What it costs
What determines vendor-review pricing for a plant
The main variables are how many vendors are in scope, how many sit in the deep-review tier because they hold standing production access, and whether contract renegotiation support is included. A single plant reviewing its core machine builders and ERP host is a lighter engagement than a multi-plant group cataloguing every gateway, integrator and SaaS vendor across sites.
How organized your contracts and access records already are also affects the timeline, since reconstructing the vendor list from invoices takes longer than starting from a maintained register. We scope a fixed fee once we see your vendor list, and the review can also run as a recurring item inside a Virtual Privacy Office retainer.
Manufacturers & Industrial IoT: Vendor security reviews questions, answered
Start by finding every connection that actually exists, not just the ones on a vendor list. A plant walk and an interview with the controls engineer routinely turns up accounts nobody remembered granting. Each one gets tiered by what it can reach, tested or reviewed for MFA and expiry, and matched against whether the vendor still needs it. The output is a decision per connection: keep as-is, tighten to time-boxed access, or revoke, backed by a contract clause covering the next one.
Documented answers on where your data is hosted, who their sub-processors are, how they authenticate support access into their own platform, what their breach-notification timeline looks like, and what happens to your data if the relationship ends. BRP's 2022 shutdown began through a compromised third party, which is exactly why a manufacturer's ERP and IIoT contracts deserve the same scrutiny as a machine builder's VPN account, not less.
Differently, but yes. An EDI provider does not touch your controllers, but it carries the order, shipment and invoice transactions your OEM relationship runs on, so the review focuses on data handling, uptime commitments and breach notification rather than remote-access controls. A disruption or leak at that layer damages the trading relationship almost as fast as a line stop would.
You confirm it rather than assume it, because standing remote-access accounts are exactly the kind of access that outlives the relationship that created them. The review checks account status directly against current vendor contracts, and the onboarding checklist we leave behind ties access removal to contract close, so the next departure does not rely on someone remembering.
Yes, indirectly but usefully. A questionnaire will often ask how you manage third-party access to your systems, and a documented vendor inventory, tiering and review cadence is a direct, evidenced answer rather than an assurance with nothing behind it. It also strengthens your own answers about segmentation and remote-access control, since those depend partly on how well the vendors touching your network are managed.
Refusal is itself a finding, not a dead end. We often shorten the ask first, since a small integrator may balk at a long form but will answer ten direct questions. If a vendor holding real production access still won't engage, the choices are compensating controls on your side, contractual pressure at renewal, or a planned replacement, and the report lays out that decision in plain terms for whoever signs off on it.
More for manufacturers & industrial iot
Other services for this niche
About this service
What's Protecting Your Business from the Next Threat?
Don't wait for a breach to expose your vulnerabilities. Let Privacy Horizon secure your data, ensure compliance, and build lasting trust.