DIGITAL SME ISAC Masterclass | Trust is a supply chain: why SMEs must manage cybersecurity beyond their own walls
About the event
Digital SMEs rarely operate alone. They rely on cloud providers, software vendors, IT partners, and subcontractors, while also being trusted suppliers to their own customers. Each of these relationships creates a pathway through which data, access, and disruption can travel.
This Masterclass explores a simple idea: an SME’s cybersecurity is no longer defined only by what happens inside its own organisation. It depends equally on the security of the products and services it uses and the confidence it can inspire as a supplier.
Attackers increasingly target the connections between organisations. A compromised supplier, insecure software update, or over-privileged service provider can become the entry point into many downstream customers. For SMEs, the challenge is heightened by limited visibility into suppliers, fewer resources for audits, and reduced capacity to recover from a major incident.
This creates a trust gap. Customers need assurance that their suppliers manage cyber risk, while SMEs often lack an affordable and proportionate way to demonstrate that assurance.
Why this matters for SMEs and open-source users:
NIS2 makes supply chain security part of cybersecurity risk management. It expects organisations to address supplier relationships, vulnerabilities, incident response, business continuity, cyber hygiene, and the effectiveness of their security measures.
Even SMEs that are not directly regulated may feel the effects indirectly. Larger customers subject to NIS2 increasingly expect their suppliers to evidence a coherent approach to security—not merely the presence of individual tools such as antivirus or backups.
Supply chain security should not become an impossible compliance burden. For most SMEs, the starting point is baseline security: fundamental, demonstrable controls such as access management, authentication, encryption, patching, backups, logging, recovery planning, and staff awareness.
This approach creates a common floor. It enables SMEs to show that they have addressed the essentials, while allowing customers to apply stronger requirements only to critical suppliers.
Where will the main contribution come from
The main contribution will come from the CIS-SME project, which works to make cybersecurity accessible and actionable for SMEs. CIS-SME will focus on the realities SMEs face: limited time and budget, overlapping customer demands, and the need for security that delivers genuine protection without enterprise-level complexity.
Rather than treating SMEs as passive recipients of customer obligations, CIS-SME positions them as active builders of trustworthy digital supply chains—helping them understand expectations, prioritise dependencies, implement essential safeguards, and communicate their security posture clearly.
REWATCH THE SESSION
Agenda
11:00 – 11:05
Welcome and introduction to the SME ISAC
- James Philpot, Senior Project Manager (European DIGITAL SME Alliance)
11:05 – 11:25
What is the NIS2 and how does it affect SMEs?
- WG Cyber Expert
11:25 – 11:50
How can SMEs secure their supply chain and reassure their customers?
- Thomas Stubbings, CEO (Complarion GmbH)
10:50 – 12:00
Q&A and closing
- James Philpot, Senior Project Manager (European DIGITAL SME Alliance)
