With a growing volume of business, acquisitions and new routes to market, businesses are constantly under threat from breaches that occur within their supply chains. It is vital to review not only the company’s own internal infrastructure but also that of vendors and partners. Palo Alto Networks follows this guideline by using three practices: 1. Review internal and external security procedures: At Palo Alto Networks, any new vendors or partners undergo a thorough vetting process to gain network access based on the connectivity standard, which includes: – A privacy review – An information security review (including a questionnaire, review of certifications, attestations, external views through tools such as Xpander, Bitsight and SecurityScorecard) – A capability rationalization review – A full integration/implementation review based on Palo Alto’s supply-chain management policy 2. Establish written security guidelines and controls: Palo Alto also has a Supplier Information Security Terms written agreement requiring suppliers to adhere to processes and protocols that minimize the likelihood of attacks – for example, cybercriminals using a supplier’s website to host malware. 3. Training/sharing security best practices with staff and vendors: Human error is still by far the most significant source of data breaches, which means it is crucial for organizations to train all staff in the best security methods. Palo Alto vets vendors and also incorporates it into the Supplier Information Security Terms. The above focuses more on the prevention side (i.e. vetting, reviewing, monitoring). On the monitoring side, Palo Alto Networks uses different tools (including third-party tools such as Xpander) that help monitor suppliers and detect supply-chain effects. Outside of technology, Zero Trust strategy is deployed across the environment to compartmentalize any potential supply-chain threat."