Supply chain: when the attacker enters through your software vendor
They did not hack your firewall — they compromised the POS update or npm library. Third-party risk for SMBs without a huge legal department.
The Hacker News covers supply chain weekly: SolarWinds was spectacular, but the local SMB suffers when a compromised WordPress plugin or MSP with stolen credentials opens their network. NIST SP 800-161 frames supply chain risk management; we adapt to SMB scale with concrete questions for critical vendors.
Minimum due diligence: MFA on remote access to your network
Minimum due diligence: MFA on remote access to your network? Cyber insurance? Breach notification in contract? Subprocessors listed? For SaaS: SOC 2 report or equivalent, data residency, data export/delete. You do not need 50 pages; you need documented answers.
Internally: SBOM on own releases, dependency pinning, review
Internally: SBOM on own releases, dependency pinning, review OAuth permissions given to integrations (does it really need to read all email?). Revoke terminated vendor tokens same day — third-party offboarding is as critical as employees.
Monitor advisories from vendors touching your stack: AWS, Microsoft, your ERP, your local payment gateway. Subscribe to CISA alerts for products you use. Patch time matters more than architectural perfection.
Supply chain in LatAm includes personal trust with "the IT guy." Formalize access: named account, MFA, limited scope, monthly log review. The relationship stays human; control can no longer be handshake only.
Operations and execution — connecting strategy with what the team ships every week.
