Irrespective of the size of your supply chain, you must ensure that it isn’t the reason your business is non-compliant with the necessary regulations and standards. Yes, it involves a great deal of continued effort, but it’s worth it. If your business is found to be non-compliant due to compliance risks within your supply chain, you will find yourself facing financial losses, loss of reputation, expensive lawsuits and a lot more. No regulator will cut you any slack for ‘not being aware’ of prevailing or imminent risks.
Fulfilling your supply chain management obligations begins with being aware of the regulations and standards that govern it. That’s exactly what this blog post aims to help you with. Over the next few minutes you will understand what supply chain compliance consists of. This being the various forms it can take, how major regulations worldwide include it in their mandates and what measures you can undertake to fulfill supply chain management obligations the right way.
Understanding Supply Chain Compliance
Fundamentally, supply chain compliance refers to an organization’s adherence to the established guidelines and requirements pertaining to tackling every type of risk pervading the supply chain and its ability to meet or exceed the expectations of its stakeholders. The guidelines and requirements can be in the form of:
- National, state/provincial and local or border/international regulatory requirements
- Industry standards (e.g. ASTM & HIPAA)
- Contractual obligations or requirements
- Customer and non-governmental organization (NGO) expectations
Achieving, demonstrating and maintaining compliance with these multiple standards requires comprehensive collaboration with your third-party partners. Your business would be able to make it happen only when both parties are fully aware of the prerequisites for full compliance.
Regulations That Incorporate Supply Chain Compliance
While most regulatory standards and regulations consider supply chain compliance management in one way or the other, some of them incorporate it as a part of their mandates. The Healthcare Portability and Availability Act (HIPAA), the EU’s General Data Protection Regulation (GDPR) and the Cybersecurity Maturity Model Certification (CMMC) are among few regulations that do so.
Let’s look at how these three regulations specify the need for fulfilling supply chain compliance requirements:
- HIPAA: Failing to effectuate a business associate agreement that defines the way your third-party vendors/partners manage personal health information (PHI) or electronic PHI (ePHI), you shall be held culpable and fined suitably.
- GDPR: GDPR’s infamous 72-hour breach notification rule applies to both data controllers (your business) and data processors (your supply chain). Even in the event of a security breach at your vendor’s end. You are responsible for notifying your customers within 72 hours.
- CMMC: If you are a member of the Defense Industrial Base (DIB), the U.S. Department of Defense (DoD) lays equal emphasis on your business and your supply chain earning the necessary levels of certification (defined under CMMC) by demonstrating compliance with NIST CSF 800-171 requirements.
Wondering whether non-compliance with these regulations has ever cost a business dearly? Marriott International’s experience of being fined under GDPR for a 2018 data breach shall put your curiosity to rest. In November 2018, security vulnerabilities at the network of a Marriott acquisition – the Starwood Hotels Group (a part of Marriott’s supply chain) – led to the personal data of over 339 million guest records being exposed.
Following a two-year long investigation, the hospitality giant was initially fined £99 million for the exposure of records of 31 million EEA residents. However, in October 2020, the fine was reduced to £18.4 million due to a range of mitigating factors and the impact of the COVID-19 pandemic. Nonetheless, Marriott International had to pay a hefty price for not detecting and mitigating a prudent supply chain risk.
Cyber Security Regulations In Healthcare
Health Industries face a wide range of ransom attacks, data theft and endpoint compromise. Now most health industries must follow cyber security regulations. This may differ for each organization. With that being said there are four critical regulations that the healthcare industries will want to follow. These being:
- (NIST) National Institute of Standards and Technology– NIST is a comprehensive set of guidelines for the industry with its goal to help minimize cyber risks. NIST privacy and security controls were only applicable to government and federal operations. With the latest revisions it now is available to any systems. NIST is mandatory for all contractors and federal employees. It is voluntary for private businesses.
- (HIPAA) Health Insurance Portability and Accountability Act– In 1996 HIPAA became a series of US federal laws. This was to help protect and regulate the privacy of information. HIPAA is mandatory for the following:
- Health plans
- Health Care Providers
- Health Care Clearinghouses
- Business Associates
- (CIS) Center for Internet Security– CIS is used the help the protect public and private organizations against cyber attacks. CIS is prioritize with a set of 18 actions to help mitigate cyber attacks. However CIS is not mandatory, but it is recommended to help healthcare cybersecurity.
- (COBIT) Control Objectives for Information and Related Technology– COBIT is a framework developed by the (ISACA) Information Systems Audit and Control Association. COBIT’s main goal is to help align IT activities with organizational objective with 6 principles:
- Provide Stakeholder Value
- Holistic Approach
- Dynamic Governance System
- Governance Distinct from Management
- Tailored to Enterprise Needs
- End-to-End Governance System
Using COBIT can help fill the gaps and help you plan how to bridge them. Although COBIT is not mandatory, It’s recommended for enabling streamlined care at a lower cost.
Precautionary Measures You Must Undertake Proactively
Having understood the definition and importance of fulfilling supply chain compliance requirements. It’s time for you to understand a list of precautionary measures you must undertake right away. Start with the ones mentioned below:
- Assess your security and compliance posture thoroughly- You must begin the process by carrying out a thorough and accurate assessment. The security and compliance posture of your business and your entire supply chain would be a place to start.
- Ask the right questions and demand checks/balances- Be prepared to quiz your supply chain on whether they mirror your business’ security and compliance posture. If they do not, don’t shy away from making it mandatory for them to be on the same page.
- Make data integrity and structure a requirement- With data it takes center stage when it comes to compliance – where it’s stored, how it’s managed and how secure it is in your business’ network (including the supply chain). Let your third-party vendors and partners know how crucial it is for them to ensure the data is upheld as sacrosanct.
- Commit to ongoing monitoring and collecting evidence of compliance- Regular threat monitoring and documented evidence of compliance will help in demonstrating your commitment to full compliance with the necessary regulations. This applies to your supply chain too.
- Assume the worst-case scenario and prepare for it- Remember this throughout the process of ensuring supply chain compliance and inculcate the same thought process among your third-party partners too.
If you’re wanting to start implementing the proactive measures we just mentioned. You can start by holding a conversation with us. We’ll map out the whole journey for you and help you through it.
