By Chris Newton-Smith, CEO at IO
Customers, suppliers and partners increasingly want confidence that the organisations they work with can protect their data, maintain operations through disruption and demonstrate that their security controls are genuinely effective.
Security and compliance are critical when working across a highly interconnected industrial network, in which manufacturers depend on a multitude of suppliers, logistics providers, contractors and technology partners. A weakness or security gap in just one organisation can have consequences far beyond its own operations, disrupting production, delaying deliveries and hugely impacting customers.
The large-scale cyber attacks on M&S, JLR, and Collins Aerospace MUSE last year highlighted the repercussions of these attacks and just how exposed these networks can become. These incidents reinforced the need for businesses to look beyond their own security controls and consider the resilience of the wider supply chain.
For organisations looking to win and retain contracts, demonstrating effective security has become an imperative part of doing business.
A certificate is only the starting point
ISO 27001 certification remains an important way for businesses to demonstrate that they have established a recognised information security management system. Certification provides valuable independent assurance, but customers also want to understand how organisations put their security commitments into practice and maintain effective governance between audits.
Procurement teams increasingly need evidence that security risks are being actively managed, appropriate controls are in place, and responsibilities are clearly assigned. It’s not a case of simply reviewing whether they have met the requirements of a standard at a particular point; they need to understand how suppliers maintain their security posture on an ongoing basis.
Research from IO found that cybersecurity managers view continuous monitoring of controls, clear executive accountability and visible compliance with other regulations as some of the strongest indicators that an organisation is compliant and resilient.
Compliance should not be treated as a tick-box exercise; it needs to be an ongoing process that reflects the organisation’s actual security posture. For industrial organisations, this is particularly important when supplying larger organisations with strict procurement requirements. Being able to demonstrate effective governance and provide evidence quickly can help build confidence, reduce friction during supplier assessments and support commercial relationships.
Bringing compliance into everyday operations
One challenge for businesses is that compliance can become a reactive exercise wherein policies are only reviewed before an audit, evidence is collected from different departments, and employees spend time searching through spreadsheets, documents and emails to demonstrate that controls are in place. Not only is this approach time-consuming and inefficient, but businesses will struggle to maintain a consistent view of the risks, creating gaps that could go unnoticed between formal reviews.
A more mature approach requires embedding compliance into everyday operations, ensuring regular reviews of risks and controls, responsibilities assigned to named individuals and evidence maintained as part of normal business processes. This gives organisations a clearer picture of where they stand and makes it easier to identify issues before they become significant problems.
There is an important distinction between regular reviews of risks and controls and continuously governing an organisation. A dashboard may show that controls are passing against an established baseline, but that does not necessarily mean the baseline is up to date and correct. Emerging threats, new tech deployments, supplier changes, or new regulatory requirements could all mean that existing policies and controls need to be updated. Governance needs to be adaptive, using the information gathered through monitoring to inform decisions and make changes where necessary.
Readiness should be the default, rather than something organisations prepare for when an audit, customer assessment or regulatory review approaches. This means maintaining a clear and reliable view of security risks, policies, ownership and supporting evidence at any given moment rather than having to piece this information together when an assessment approaches. Evidence should accumulate as part of normal business activity, with policies and risk assessments reviewed and updated as circumstances change.
A centralised compliance management platform can connect policies, risks, controls, evidence and responsibilities, reducing reliance on fragmented processes, duplicated effort and making compliance easier to manage across teams.
However, human expertise and oversight remain essential to interpreting risks, making informed decisions and ensuring that controls remain suitable as the business changes – technology alone is not the answer. Governance needs to be built into how the business operates, with senior leaders having visibility of the risks the organisation faces, how those risks are being managed and where further action is required. It should not be a separate layer of administration that is switched on before an audit or after an incident. It needs to be a standing capability, supported by clear accountability and the ability to adapt as circumstances change.
Security as a supply chain priority
Industrial businesses must also recognise that their own compliance is only a small part of the picture, and they must understand the risks posed by their suppliers and partners, particularly where third parties have access to sensitive information, business systems or critical operations.
This requires a consistent approach to assessing supplier risk, establishing clear expectations and reviewing whether those expectations continue to be met. A supplier’s certification can provide useful assurance, but it should form part of a broader assessment that considers how security is managed in practice.
Establishing a structured approach to compliance can help businesses respond more efficiently, avoid duplicating effort and demonstrate that security is taken seriously. This is particularly important for smaller suppliers, as these expectations can feel burdensome, particularly when different customers request similar information in different formats.
Businesses that can provide clear, accessible evidence of their security controls are also better placed to build trust with prospective customers and demonstrate that they are reliable partners.
Turning compliance into a business advantage
The regulatory environment adds another layer of complexity, and organisations often need to meet multiple standards and regulatory requirements, each placing demands on how risks are assessed, controls are maintained, and evidence is provided.
A well-managed compliance framework helps businesses respond to these changing requirements without having to rebuild their processes every time a new obligation emerges. It can also help identify gaps earlier, improve readiness for audits and reduce the risk of costly surprises.
Ultimately, customers and suppliers are not expecting organisations to guarantee that a cyber incident will never happen; they simply want confidence that the business understands its risks, has appropriate controls in place and can demonstrate that those controls are being managed effectively. For industrial organisations, this confidence enables them to protect supply chains, support operational resilience and strengthen their relationships.
Businesses that build on certification and make governance, clear accountability and ongoing risk management a continuous, visible and repeatable process will be better positioned to meet customer expectations, respond to disruption and compete in a market where security assurance is increasingly part of the deal.
