Securing Oil & Gas Digital Supply Chains: A Vendor Risk Management Framework for IoT and Cyber-Physical Systems

The oil and gas industry’s accelerated digital transformation—driven by cloud computing, IoT, and edge technologies—has significantly expanded the attack surface, with third-party vendors emerging as critical points of vulnerability. Existing frameworks, such as NIST CSF and ISO/IEC 27036, while comprehensive, fall short of addressing the sector’s unique cyber-physical infrastructure and real-time operational demands. This study addresses that gap by proposing the Vendor Cyber Risk Management Framework (VCRMF), a domain-specific model that integrates dynamic vendor tiering, continuous threat monitoring, and sector-aligned controls. Developed through an iterative process combining literature synthesis, threat landscape analysis, expert interviews (n=18), and a validated midstream case study, the VCRMF demonstrated a 72% improvement in vendor risk visibility and reduced incident response times from 14 days to 36 hours. Practitioners across cybersecurity, OT, and procurement domains rated the framework highly (average rating: 4.7/5), citing its adaptability across upstream and downstream operations and alignment with evolving standards like IEC 62443 and DORA. The VCRMF offers a practical, validated approach to mitigating vendor-related cyber risks in the digital supply chain, contributing both operational value and regulatory readiness.