Supply Chain Cybersecurity for Manufacturers: Vendor Access, ERP Dependencies and OT Continuity

By Denrich Sananda 04-11-2026 6 min read

Supply chain cybersecurity is usually discussed as a procurement problem: assess your vendors, collect their questionnaires, check their certifications. That work matters, but it addresses the risk of buying something compromised. It does almost nothing about the larger and more immediate exposure, which is that your plant depends on systems and people you do not control, and several of those dependencies can stop production without anyone attacking your plant at all.

This post takes the asset owner's view. Not what you demand from suppliers, but which of your own operational dependencies would hurt you. Our supply chain cyber risk assessment playbook covers the vendor assessment side, and our guide to SBOM for OT procurement covers component provenance.

Four dependencies that stop plants

Dependency	How it stops you
Vendor remote access	OEMs and integrators hold standing access to your controllers, often through their own tooling and their own credentials. A compromise at their end is a compromise of your plant, and you may learn about it from the news.
ERP to production coupling	Work orders, recipes, batch instructions and material movements often flow from a business system into production. If the ERP stops, production may have nothing to run on even though every controller is healthy.
Logistics and distribution platforms	Transport management, carrier portals and warehouse systems. You can make product and still ship nothing.
Cloud services under production	Historians, analytics, licensing servers and increasingly authentication. A licensing or identity service outage can stop software you assumed was local.

The licensing and identity case is the one most often missed. Engineering software that validates a license against a cloud service, or an HMI that authenticates against a cloud identity provider, has an external dependency that was never on the network drawing. We find these during dependency mapping, not during penetration tests.

The question that reframes the conversation

Ask not "which of our vendors is secure" but "if this vendor disappeared for two weeks, what stops". Run it across your top ten suppliers and service providers. The answers are usually uncomfortable and they immediately reorder your priorities, because the vendor with the weakest security posture is frequently not the one whose absence would hurt most. Criticality and security posture are different axes, and most programs only measure one.

Vendor remote access, specifically

This is the single highest-risk item on the list and the one with the clearest remedy. What we look for:

Standing versus brokered access. Permanent VPN accounts for integrators are still common. Access that must be requested, approved, time-boxed and recorded is the target state.
Whose identity. Shared vendor accounts make attribution impossible. Named individuals, on your identity system where feasible.
Whose tooling. Vendor-supplied remote access appliances sitting inside your perimeter, managed by them, patched by them, are a dependency you did not choose.
What they can reach. Access to one skid should not be access to the control network. This is a segmentation question. See our segmentation audit guide.
How fast you can revoke. If a vendor is breached tonight, how long to cut every path they hold. If the answer is not minutes, that is the finding.

Mapping the dependencies

The exercise is unglamorous and it is the whole job. For each production line, list what must be working for it to run and for its output to ship. Include business systems, external services, licensing, identity and the people. Then mark which of those you control, which a vendor controls, and which nobody has thought about. Our guide to non-disruptive OT asset discovery covers establishing what is actually there, which is the prerequisite.

What makes this different from a standard business continuity plan is direction. Continuity planning usually asks what happens if the plant stops. Dependency mapping asks what else stopping would stop the plant, and that is the question that catches ERP coupling and cloud licensing.

What recovery actually requires

Three things we test and most organizations have not:

Can you run in a degraded mode without the business systems, for how long, and does anyone know the procedure.
Are controller configurations and recipes backed up somewhere that does not depend on the systems that would be down.
Can you reach your vendors if your normal communications are affected, and do you have out-of-band contacts.

Our analysis of how ransomware stops a plant without touching a PLC goes into the operational dependency mechanism in detail.

Why Choose Arista Cyber

We map operational dependencies on live industrial sites and we assess vendor access as an architecture problem rather than a paperwork exercise. Our consultants hold functional safety credentials alongside OT security certification, so continuity recommendations account for the safety case. See our OT cybersecurity services and our case studies.

Next Steps

Run the two week question across your top ten vendors and service providers. It takes an afternoon with the right people in the room, it needs no tooling, and it will tell you which dependencies deserve a real assessment. Start there rather than with a questionnaire campaign.

Common Questions

Is supply chain cybersecurity the same as vendor risk assessment?

They overlap but are not the same. Vendor assessment manages the risk of what you buy. This article addresses operational dependency: which external systems and people, if unavailable or compromised, would stop your production.

What is the biggest supply chain risk to a plant?

In our assessments, vendor remote access. Standing access held by integrators and OEMs, often with shared credentials and broad reach, is both common and high consequence.

Can an ERP outage really stop production?

Yes, where work orders, recipes or material movements flow from the business system into production. Controllers can be entirely healthy with nothing to run on.

How does this relate to SBOM and supplier questionnaires?

Those address what you procure. This addresses what you depend on operationally. Both are needed, and most organizations have started on the first and not the second.

Where do we start?

Ask what stops if each of your top vendors disappeared for two weeks. It requires no tooling and reorders your priorities faster than any assessment.

If your main integrator was breached tonight, how fast could you cut their access?

Arista Cyber maps operational dependencies for industrial manufacturers and assesses vendor access as an architecture problem: standing access, identity, reach, revocation speed and degraded-mode operation.

Request a dependency assessment