27/10/2026
Briefing

Key takeaways

  • Life sciences organisations often have complex and critical supply chains, and understanding and addressing cyber security risk within these supply chains is critical to help ensure operational continuity and regulatory compliance.

  • Supply chain cyber security must be addressed throughout the supplier lifecycle and be built into the processes, controls and governance structures applied by life sciences organisations to their supply chain from initial procurement through to final exit of a supplier.

  • In particular, appropriate assurances and information relating to a supplier’s cyber security profile should be obtained during the procurement phase and such assurances should be translated into appropriate protections and rights for the life sciences organisation in its contract with the supplier. 

  • Effective ongoing oversight and monitoring of critical suppliers is also an important component of maintaining a robust cyber security profile. The board and senior management must be appropriately apprised on an ongoing basis of cyber security risks and mitigants in the supply chain of a life sciences organisation so as to help facilitate effective decision making and response in relation to cyber security.

Introduction and background

The importance of cyber security within organisational supply chains cannot be overstated and this is particularly true in the life sciences sectors given the critical and sensitive nature of their activities. In this briefing, we outline practical areas and steps that life sciences organisations should have front of mind when looking to ensure cyber security within their critical supply chains.

The laws relevant to managing cyber security risk within supply chains have expanded significantly in recent years. It is important for life sciences organisations to establish a clear picture of the laws that apply to them in this area. These laws may include NIS2; the GDPR; the EU Cyber Resilience Act; the EU AI Act; the European Health Data Space Regulation; the Medical Devices Regulation; the In Vitro Diagnostic Medical Devices Regulation; and the EU Data Act.

Life sciences organisations should also be mindful of regulatory guidance relevant to cyber security within the supply chain, such as guidance issued on this topic by Ireland’s National Cyber Security Centre and the EU Agency for Cybersecurity.

Cyber security through the supply chain lifecycle

Regulatory expectation is that life sciences organisations will ingrain effective cyber security measures into each phase of the supply chain lifecycle. To facilitate this, organisations should have an overarching, documented strategy or policy which is focused on identifying, mitigating and managing cyber security risk through each phase of the supply chain lifecycle rather than addressing such matters in a less structured and consistent manner. We outline below certain key cyber security considerations and practical steps for each phase of the supply chain lifecycle.

Phase 1: Due diligence and supplier selection

At the outset of any significant procurement process, an organisation should assess the critical risks that the system, service or product it proposes to procure could present to that organisation. Cyber security should be one area of risk that is addressed as part of this exercise. In particular, life sciences organisations should:

  • Consider whether identified cyber security risks fall within the organisation’s risk tolerances and determine steps that can be taken to mitigate cyber security risks
  • Identify assurances that can be provided by prospective suppliers as part of the procurement and selection process to help mitigate identified cyber security risks (e.g. compliance with industry-accepted standards such as ISO 27001; robust business continuity arrangements; a high level of control/transparency over subcontractors; track record of avoiding and/or addressing security incidents; appropriate security policies/documentation; robust processes on software development, patching and vulnerability disclosure, etc.)
  • Consider interaction of prospective suppliers with other key existing suppliers and whether the prospective suppliers will create a significant concentration risk for the organisation. This could occur where the supplier will act as a single point of failure for a critical function. In such circumstances, the organisation may wish to consider a multi-supplier model.  

Phase 2: Contract

Once risks and assurances from a cyber security perspective have been identified as part of the supplier due diligence and selection phase, they should be appropriately addressed in the contract with the supplier in order to ensure that cyber security assurances/representations provided by the supplier during the procurement process are supported by clear protections and rights for your organisation in the contract. 

The types of cyber security-related provisions that a life sciences organisation may wish to include in its contract with a new critical supplier include:

  • Commitments around compliance with relevant cyber security laws, regulatory guidelines and industry standards
  • Details of minimum-security measures that the supplier must implement and maintain (e.g. encryption standards, multi-factor authentication, role-based access controls, penetration testing, timely patching, etc.)
  • Incident notification and remediation obligations
  • Security flow down requirements for subcontractors and notice or consent requirements in relation to subcontractors
  • Commitments around maintaining and testing an industry standard business continuity plan
  • Responsibility/liability for cyber security failures
  • Obligations relating to exit, including transitional support and secure return of data

Where the supplier is utilising/supplying AI as part of its products or services, this will likely impact the cyber security risk profile of that supplier and certain contractual assurances should be sought from the supplier (e.g. obligations to disclose use of AI; assurances from a data protection perspective; prohibition on the use of the organisation’s sensitive health, personal or security data to train or improve any AI tools, etc.).

Phase 3: Ongoing monitoring and oversight

Once a critical new supplier is onboarded, the life sciences organisation should ensure that this supplier is effectively overseen and monitored on an ongoing basis so as to help identify and mitigate any cyber security risk that the supplier may present. As part of this, the supplier should be obliged to provide ongoing reporting on its performance and should immediately report any significant cyber security incidents that arise. The supplier should also provide the organisation with information on emerging cyber threats and vulnerabilities and how they are being addressed by the supplier.

Organisations should also maintain an accurate and up-to-date inventory of their critical suppliers, systems and datasets. This should help the organisation to better understand cyber security risks presented by critical suppliers and to effectively oversee, mitigate and manage such risks. As part of this, organisations should periodically revisit the cyber security risk profile of their key suppliers to ensure that this profile remains appropriate and sufficiently addressed in light of any changes in environmental factors such as the products/services provided by the suppliers and the cyber security risks presented by the suppliers.

Regulatory requirements such as NIS2 also emphasise the important role the board must play when it comes to monitoring and overseeing cyber security risk. For example, Article 20 of NIS2 requires the board to approve organisational cyber security risk management measures and to oversee the implementation of these measures. As such, the role of the board in overseeing cyber security risk must be appropriately addressed by life sciences and pharma organisations. The board should also receive appropriate and recurring training on cyber security to help them fulfil this role.

Phase 4: Exit and transition  

The decommissioning of existing systems, services and products, and the transition to replacement systems, services and products, can be a sensitive exercise that can expose life sciences organisations to significant cyber security risks in the absence of appropriate processes, controls and advance planning.  Measures and commitments relating to this transition should be built into the contract with the supplier to help minimise cyber security risk.

In particular, there should be contractual requirements around developing an exit plan at the outset of the relationship between the life sciences organisation and the supplier, and this should be supplemented by contractual obligations on the supplier to test this exit plan to ensure it remains fit for purpose. The nature of the commitments included in the exit plan should include obligations to continue providing services to the same standards (including cyber security standards) during the exit period and obligations on the supplier around the secure and verifiable destruction/return of sensitive data.   

Conclusion

The key takeaway for life sciences organisations examining how they address cyber security risks in their supply chains is that cyber security must be built in from the beginning of the supply chain lifecycle and carried all the way through to supplier exit. The processes and controls deployed by an organisation for this purpose should also be subject to recurring review to ensure that they remain ‘fit for purpose’. The prominent role of the board when it comes to the oversight and monitoring of cybersecurity risk must also be understood and addressed to help ensure that cyber security controls built into the supply chain lifecycle are both effective and compliant with regulatory rules.  

For more information, please contact our Technology and Innovation Group or our Life Sciences Group.