Not automatically. Start with the suppliers whose services could be affected and whose failure would matter to your business. The goal is to find out whether you need to act, not to collect a reassuring email from every company you buy from.
Broader outreach can make sense when a flaw affects a widely used software component and you cannot yet identify which services contain it. Even then, prioritize the important relationships rather than waiting for every reply.
Check what you already know
Read the software maker’s advisory. Then check supplier notices and your own service records. A notice may already identify affected products and the action customers need to take. Make sure it covers the service and version you actually use.
Hidden dependencies are a real problem. During Log4Shell, organizations could be using the affected component without knowing it. NCSC advised asking developers and suppliers when its presence was unclear. That is a reason to investigate uncertainty, not proof that every supplier is vulnerable.
Decide who needs a direct follow-up
- Contact suppliers known or reasonably suspected to use the affected software.
- Prioritize services that hold sensitive data or have access to your systems.
- Include services you could not easily operate without.
- Treat missing information about an important service as an open question. Do not quietly mark it unaffected.
This is a practical application of risk-based supply-chain oversight. A supplier’s annual spend or brand name does not tell you how much its failure would affect you.
Ask about your service, not their whole security program
A short request is usually more useful than resending the onboarding questionnaire:
- Are we affected? Does the service we use contain the vulnerable component? Which parts did you check?
- What have you done? What was fixed or temporarily protected? What remains open?
- Was it exploited? Have you checked for signs of compromise? What can you currently say about our data or service?
- What happens next? Do we need to take action? When will you provide the next update?
Ask for enough support to judge the answer. A product-specific advisory may be sufficient in one case. An important unresolved exposure may need a technical discussion and evidence that the fix reached the affected systems. You do not need every supplier’s raw security logs.
Keep uncertainty visible
“Patched” does not answer whether someone gained access before the patch. “No evidence of compromise” is also more useful when you know what was checked and whether the investigation is still open. A previous SOC report or penetration test does not settle a new vulnerability question.
Urgency depends on the exposure and likely impact. Active exploitation warrants faster action; do not wait for the next annual vendor review. NCSC’s rapid-response guidance explains why updates and investigation may both be needed.
If an important supplier cannot answer, involve your security team and service owner. Decide whether temporary restrictions or a contingency are appropriate. Keep a short record of the service, current answer, decision and next follow-up. Silence is not confirmation of safety.
For the wider picture, see which vendors need the most oversight. Keep this review focused on the new issue rather than rebuilding the whole assessment.