.png)
Irrespective of the size of your supply chain, you must ensure that it isn’t the reason your business is non-compliant with the necessary regulations and standards. Yes, it involves a great deal of continued effort, but it’s worth it. If your business is found to be non-compliant due to compliance risks thriving within your supply chain, you will find yourself facing financial losses, loss of reputation, expensive lawsuits and a lot more. No regulator will cut you any slack for ‘not being aware’ of prevailing or imminent risks.
Fulfilling your supply chain management obligations begins with being aware of the regulations and standards that govern it. That’s exactly what this blog post aims to help you with. Over the next few minutes, you will understand what supply chain compliance is, the various forms it can take, how major regulations worldwide include it in their mandates and what measures you can undertake to fulfil supply chain management obligations the right way.
Understanding Supply Chain Compliance
Fundamentally, supply chain compliance refers to an organisation’s adherence to the established guidelines and requirements pertaining to tackling every type of risk pervading the supply chain and its ability to meet or exceed the expectations of its stakeholders. The guidelines and requirements can be in the form of:
· National, state/provincial and local or border/international regulatory requirements
· Industry standards (e.g. POPIA)
· Contractual obligations or requirements
· Customer and non-governmental organisation (NGO) expectations
Achieving, demonstrating and maintaining compliance with these multiple standards requires comprehensive collaboration with your third-party partners. It’s only fair to say that your business would be able to make it happen only when you and your supply chain are fully aware of the prerequisites for full compliance.
Regulations That Incorporate Supply Chain Compliance
While most regulatory standards and regulations consider supply chain compliance management in one way or the other, some of them incorporate it as a part of their mandates. The South Africa's Protection of Personal Information Act (POPIA), Healthcare Portability and Availability Act (HIPAA), the EU’s General Data Protection Regulation (GDPR) and the Cybersecurity Maturity Model Certification (CMMC) are among few regulations that do so.
Let’s look at how these four regulations specify the need for fulfilling supply chain compliance requirements:
POPIA: Under Section 21 of POPIA, a responsible party, akin to a data controller, is mandated to ensure that when personal information is processed by an operator, similar to a data processor, certain obligations are met. These include selecting an operator with adequate security measures, ensuring that personal information is processed only as instructed, monitoring the operator's compliance, and implementing measures to address security breaches in the processed personal information.
HIPAA: If you fail to effectuate a business associate agreement that defines the way your third-party vendors/partners manage personal health information (PHI) or electronic PHI (ePHI), you shall be held culpable and fined suitably.
GDPR: GDPR’s infamous 72-hour breach notification rule applies to both data controllers (your business) and data processors (your supply chain). Even in the event of a security breach at your vendor’s end, you are responsible for notifying your customers within 72 hours.
CMMC: If you are a member of the Defence Industrial Base (DIB), the U.S. Department of Defence (DoD) lays equal emphasis on your business and your supply chain earning the necessary levels of certification (defined under CMMC) by demonstrating compliance with NIST CSF 800-171 requirements.
Wondering whether non-compliance with these regulations has ever cost a business dearly?
Yes, the Information Regulator has slapped the Department of Justice and Constitutional Development (DoJ&CD) with a historic R5 million fine, for breaching the Protection of Personal Information Act (POPIA). This is the first time a South African organisation has been fined under the country's POPIA data privacy law. There have been many other instances where non-compliance with data protection regulations, including the Protection of Personal Information Act (POPIA) in South Africa, has resulted in significant financial penalties and reputational damage for businesses.
While specific cases may not always be widely publicised due to confidentiality concerns or settlements reached outside of court, it's essential to understand that regulatory bodies, such as the Information Regulator in South Africa, have the authority to investigate complaints, conduct audits, and impose penalties for non-compliance with POPIA.
As of my last update in January 2022, POPIA became fully enforceable in July 2021. While there might not be a plethora of publicised cases yet, it's reasonable to anticipate that enforcement actions will increase over time as both regulators and the public become more aware of data protection rights and obligations.
Marriott International’s experience of being fined under GDPR for a 2018 data breach shall put your curiosity to rest. In November 2018, security vulnerabilities at the network of a Marriott acquisition – the Starwood Hotels Group (a part of Marriott’s supply chain) – led to the personal data of over 339 million guest records being exposed.
Following a two-year long investigation, the hospitality giant was initially fined £99 million for the exposure of records of 31 million EEA residents. However, in October 2020, the fine was reduced to £18.4 million due to a range of mitigating factors and the impact of the COVID-19 pandemic. Nonetheless, Marriott International had to pay a hefty price for not detecting and mitigating a prudent supply chain risk.
Precautionary Measures You Must Undertake Proactively
Having understood the definition and importance of fulfilling supply chain compliance requirements, it’s time for you to understand a list of precautionary measures you must undertake right away. Start with the ones mentioned below:
Assess your security and compliance posture thoroughly: You must begin the process by carrying out a thorough and accurate assessment of the security and compliance posture of your business and your entire supply chain.
Ask the right questions and demand checks/balances: Be prepared to quiz your supply chain on whether they mirror your business’ security and compliance posture. If they do not, don’t shy away from making it mandatory for them to be on the same page.
Make data integrity and structure a requirement: Data takes center stage when it comes to compliance – where it’s stored, how it’s managed and how secure it is in your business’ network (including the supply chain). Let your third-party vendors and partners know how crucial it is for them to ensure the data is upheld as sacrosanct.
Commit to ongoing monitoring and collecting evidence of compliance: Regular threat monitoring and documented evidence of compliance will truly help you in demonstrating your commitment to full compliance with the necessary regulations. This applies to your supply chain too.
Assume the worst-case scenario and prepare for it: Remember this throughout the process of ensuring supply chain compliance and inculcate the same thought process among your third-party partners too.
If you’re wondering how to start implementing the proactive measures we just mentioned, you can start by holding a conversation with us. We’ll map out the whole journey for you and help you through it.
Article curated and used by permission.
Data Source:
Comments