The Parties

HopingToGetCareHospital is a regional hospital network with a formal vendor approval process. Medical devices go through procurement review before any purchase order is raised. The approved vendor list exists precisely to ensure the hospital only buys from verified, certified suppliers.

WhiteListedVendorCo is the approved medical device supplier. FDA-cleared. ISO 13485 certified. Audited two years prior. No adverse findings on record. For every purpose the hospital's procurement team can see, WhiteListedVendorCo is a safe choice.

VendorToWhiteListedVendor is a contract manufacturer in Eastern Europe. WhiteListedVendorCo subcontracts all physical board assembly to them. The hospital does not know this arrangement exists.

OriginalRawPartSupplier is the microcontroller source VendorToWhiteListedVendor has used for four years. Reliable. Known. Currently non-operational — political instability in its country has collapsed the supply pipeline.

ReplacedRawPartSupplier is a vendor VendorToWhiteListedVendor has never worked with before. They were contacted by email. They replied with a price quote. That is the entirety of the due diligence.

Core Risk

HopingToGetCareHospital believed it was buying from one trusted supplier. In reality, it was depending on a four-tier chain with no visibility into subcontracting, component substitution, or upstream supplier assurance.

The Story

HopingToGetCareHospital's procurement committee raises a purchase order for 1,200 infusion pump controllers. WhiteListedVendorCo is on the approved vendor list. FDA-cleared. Audited two years prior. No flags. The order is approved.

What HopingToGetCareHospital does not know — because it never asked — is that WhiteListedVendorCo does not manufacture the controller boards. Assembly is subcontracted to VendorToWhiteListedVendor. No disclosure. No contractual requirement to disclose.

VendorToWhiteListedVendor sources microcontrollers from OriginalRawPartSupplier. That supplier is mid-crisis. Lead times have tripled. The delivery deadline for WhiteListedVendorCo is not moving.

VendorToWhiteListedVendor's procurement manager contacts ReplacedRawPartSupplier for the first time. No audit. No site visit. One email exchange and a price quote.

ReplacedRawPartSupplier ships on time. The chips look right. The test bench passes. Nobody checks the firmware. There is no SBOM from ReplacedRawPartSupplier. There is no PUF-based attestation on the components. VendorToWhiteListedVendor does not require it. WhiteListedVendorCo does not require it. HopingToGetCareHospital does not require it.

The infusion pumps pass incoming inspection at HopingToGetCareHospital and go live across three wards.

Eleven weeks later, a biomedical engineer runs a routine firmware audit. The hash on the controller board does not match WhiteListedVendorCo's documentation. WhiteListedVendorCo has no documentation for that hash — because they never generated one. VendorToWhiteListedVendor has no record of which chips came from which supplier.

HopingToGetCareHospital cannot identify which units are compromised. All 1,200 pumps are pulled from service. Four tiers. Zero attestation. Patients on affected wards moved to manual monitoring.

How the Failure Unfolded

Step 1 — Approved vendor selected
HopingToGetCareHospital raises the purchase order relying on WhiteListedVendorCo's approved status, certifications, and prior audit history.
Step 2 — Hidden subcontracting layer
WhiteListedVendorCo does not build the boards itself and uses VendorToWhiteListedVendor for physical assembly without that arrangement being visible to the hospital.
Step 3 — Supply disruption
OriginalRawPartSupplier becomes unable to fulfill orders because political instability collapses the supply pipeline and lead times triple.
Step 4 — Unvetted replacement introduced
VendorToWhiteListedVendor switches to ReplacedRawPartSupplier without audit, site visit, or structured due diligence.
Step 5 — Assurance controls missing
No firmware validation, no SBOM, no component attestation, and no traceability requirements exist across the chain.
Step 6 — Operational impact
The hospital cannot isolate affected units, so all 1,200 infusion pumps are pulled from service and patients move to manual monitoring.
GRC Questions Raised by This Case Study
  1. Why was WhiteListedVendorCo not contractually required to disclose subcontracted manufacturing?
  2. Why did HopingToGetCareHospital approve the supplier relationship without sub-tier visibility requirements?
  3. Why were supplier substitution events not treated as high-risk changes requiring revalidation?
  4. Why did VendorToWhiteListedVendor have no minimum due diligence standard before sourcing from a first-time vendor?
  5. Why were SBOMs, firmware baselines, and component attestation not required anywhere in the procurement or assurance process?
  6. Why was component traceability weak enough that compromised units could not be identified individually?
Back to GRC Hub Continue to Solution