Supply-chain risk management is the practice of identifying, tracking, and reducing risk in the suppliers, components, software packages, and service dependencies that support an organization’s technology and operations. It goes beyond checking contracts: teams map what they rely on, who provides it, where it is built or hosted, and what would happen if that source failed or was compromised.
This matters in cyber security because attackers often target the weakest link outside the main network, such as a third-party vendor, a software update path, or a managed service with broad access. Strong supply-chain risk management helps defenders spot untrusted components, verify updates, enforce security requirements, and plan for fallback options. In practice, it includes vendor inventories, dependency scanning, code-signing checks, access limits, and regular review of supplier posture so one compromised partner does not become a path into many systems.