EDI, customer portals and the quiet compliance layer between you and your biggest buyer

Ask a supplier what connects them to their largest customer and the answer is a relationship, a quality record, a price. Ask their IT provider the same question and the answer is more literal: an EDI connection that carries releases and ASNs, a customer portal login where somebody acknowledges orders and uploads certs, and a shared inbox where the schedule changes land. That plumbing moves the revenue. When it stops, shipments stop, and the customer’s scorecard does not have a column for “it was an IT problem.”

The plumbing is also a security surface, and it is one of the least examined in most plants. It grew connection by connection as customers were won, each one set up by whoever was available that week, to whatever standard the customer’s onboarding packet demanded and no further. A supplier with 6 major customers typically has 6 different arrangements, 0 documented.

What the surface actually looks like

Walk through it the way an auditor, or an attacker, would:

• The EDI path itself. Maybe a VAN, maybe AS2 direct, maybe SFTP to the customer, maybe a cloud EDI service in the middle. Each hop has credentials and certificates, and certificates expire. A surprising share of “EDI is down” emergencies are an expired cert nobody owned, discovered when releases stop flowing and the line schedule goes blind
• Portal accounts. The supplier-side logins for the customer’s portal are frequently shared, “the Chrysler login” taped to a monitor in customer service, because the portal charges per seat or because turnover outran account requests. A shared credential into the system that carries your orders and your banking details is exactly the credential a phish goes hunting for
• The translator and the ERP connection. EDI data flows into order entry, sometimes through aging translation software on a server nobody restarts. That box sits on the business network, touches the ERP and rarely appears on anyone’s patch list
• The banking details at the end of it. Supplier portals are where remit-to addresses and bank accounts get maintained. Compromise a portal login and you do not need to hack anyone’s bank; you update a form and the customer’s accounts payable does the rest. This is the supplier-side variant of the fraud covered in wire fraud and the first 48 hours

Why this is becoming a questionnaire topic

Large buyers have noticed that their supply chain’s weakest link is rarely their own network. The security questionnaires flowing down to suppliers, the ones we walked through in the customer security questionnaire walkthrough, increasingly ask directly about the connection layer: who administers your EDI, are portal accounts individual and MFA-protected, how quickly would you detect an interruption, who can change banking information and with what approval. Automotive OEMs ask through their supplier mandates. Big-box retail asks through compliance programs with chargebacks attached. The questions are answerable in an afternoon if the arrangements are clean, and unanswerable if nobody has looked.

Cleaning it up without breaking shipments

The fix list is short and none of it requires re-platforming:

1. Inventory the connections. One page per customer: transport method, credentials and certs with expiry dates, the named owner, the customer’s technical contact and what happens, concretely, if it goes down on a Friday
2. Individualize and MFA the portal logins. Named accounts per person wherever the portal allows it, MFA wherever offered, and the password manager instead of the sticky note. Where a portal truly forces a single shared account, vault it, restrict who can retrieve it and rotate it on every departure
3. Lock the banking-change path. Decide who may change remit-to details on any customer portal, require a second person’s confirmation and tell your customer’s buyer that changes will always be verified by phone. That sentence in an email has defused real fraud attempts
4. Put the EDI server on the patch list. And on the backup list, and behind the same monitoring as the ERP. It is revenue infrastructure; treat it like the ERP’s front door, because it is
5. Rehearse the outage. A 30-minute tabletop: EDI is down at 7 a.m., releases are not flowing, who calls the customer, who ships from the last known schedule and what does the contract say about manual fallback? Suppliers who can answer keep their delivery rating through an outage. The format is the same one from tabletop exercises that produce decisions

The uptime obligation nobody signed separately

Buried in most supply agreements is language about order acknowledgment windows and ASN timing, which quietly means your EDI availability is a contractual obligation. Ransomware that takes out the business network takes out EDI with it, which is how a cyber incident becomes a scorecard event and, in automotive, a chargeback. The recovery sequencing we laid out in what ransomware downtime costs a manufacturer applies directly: shipping and the customer-facing data paths restore near the front of the line, not after email.

The suppliers who handle this well treat the customer connection layer as what it is: the most valuable circuit in the building, owned by someone, documented on a page and defended like the revenue it carries. The broader supplier security picture, questionnaires, NIST 800-171 flow-downs and plant-floor segmentation, is in our manufacturing cybersecurity guide.

Atticus Rowan supports suppliers who live and die by these connections, and the connection inventory is one of the first artifacts we build. If your EDI knowledge currently lives in one person’s head, start a conversation before that person takes a vacation.