Why Singapore SMEs should treat cybersecurity as a sales issue

Small services firms preparing for significant corporate accounts often encounter new questions about cybersecurity. These inquiries are not about understanding the supplier's product but rather about ensuring customers can safely depend on the business. Treating cybersecurity as part of an SME's growth strategy is crucial because winning a customer's interest and becoming an acceptable supplier are two distinct challenges. A compelling proposal does not establish trust on its own.

Microsoft exemplifies how security is linked to supplier eligibility through its Supplier Security and Privacy Assurance program. Enrolled suppliers must undergo annual self-attestation against applicable requirements, with additional assurance for higher-risk activities. This demonstrates a clear commercial distinction: possessing the ability to deliver a service does not guarantee the right to do so.

When pursuing larger customers, SMEs should inquire about security expectations alongside budget, scope, and delivery dates.

A supplier's risk extends beyond the business itself. For instance, DBS reported a ransomware incident at its printing vendor, Toppan Next Tech, which potentially compromised personal information of about 8,200 customers. Although DBS's systems remained unaffected, the customer's exposure highlights the importance of supplier due diligence. Asking about access controls or incident response helps understand what happens after information leaves the company's environment.

While a company's choice of a trusted cloud provider like Amazon Web Services indicates security measures, it does not fully address the customer's concerns. AWS operates under a shared responsibility model, where customers retain control over data, permissions, applications, and security configurations. For SMEs, this means explaining their operating practices and substantiating claims rather than merely naming a reputable provider.

To prepare for significant customer requests, SMEs should compile a collection of security evidence before being asked. Start by documenting the services delivered, external providers involved, access approval processes, incident handling, and relevant certifications. Maintain records that can be retrieved by authorized staff. This distinction between assertions and evidence is crucial.

While a statement about the existence of backups differs from a record showing their restoration, maintaining proper documentation establishes credibility with potential customers.