GorWay - Industrial oil purification & water treatment solutions

The Tools and Info You Need

Cyberattacks on supply chains are on the rise and are growing in sophistication. These attacks can disrupt business operations and inflict enormous financial and reputational costs. Efforts to prevent cyberattacks must match the intensity of those seeking to exploit our vulnerabilities. GorWay wants to provide tools and resources our suppliers need to tackle these threats.

Must-Read Cyber News

Assessing the Current Threat Landscape

An interview with Muhittin Hasancioglu, GorWay's Chief Information Security Officer.

What are top cyber security issues confronting GorWay and its supply chain?

“In the past six months, we’ve seen a shift in behaviour from organized crime and possibly even nation-states," says CISO Muhittin Hasancioglu. "Instead of immediately trying to make money, they are increasingly focused on disrupting manufacturing and supply chains.”

“We need to be alert.”

Guidance on personnel security requirements

What our suppliers need to know. Download a four-page guide for complying with GorWay personnel security requirements.

Download

Incident response guidance

A toolkit and tabletop exercise introduction for suppliers.

Download

Phishing test

Let’s see if you can find the malicious emails. Most of the malicious emails in this quiz are real attacks we have seen. Good luck.

View

Supplier Requirements

GorWay is committed to protecting our information and operating cyber safe systems, services and products for our customers. We depend on our suppliers to meet the same standard. Collaboration is critical to maintaining strong security and protecting our businesses and customers.

All GorWay suppliers must comply with baseline requirements contained in the GorWay Supplier Minimum Cyber Security Standards. Additional compliance measures may be required by national and local governments and regulators. Please contact your buyer if you require further information.

General

Basic cyber security requirement for all Suppliers

General

Standard requirements and best practices for all suppliers:

Best practices to help you maintain good cyber hygiene are supplied in the adjacent links.
The Third Party IT Acceptable Use Policy applies to third party users of GorWay IT systems. Your manager will provide instructions on how to acknowledge your acceptance of this policy.

GorWay Supplier Cyber Security Standards

Global Supplier Portal

Third Party IT Acceptable Use Policy

US Defence

cyber security requirement for US-based Suppliers

US Defence

Additional requirements and best practices for US Defence Suppliers:

Most suppliers supporting US Defence contracts have requirements to comply with DFARS 252.204-7012 and 252.204-7020. Compliance to these requirements is captured via the annual PIB process.
You are recommended to begin planning for the Cybersecurity Maturity Model Certification (CMMC) developed by the Department of Defense (DoD). The model combines various Cyber Standards and best practices promoting basic cyber hygiene to detailing advanced measures to protect businesses.
To assist in planning for CMMC, the DIB SCC Industry Task Force has created a helpful resource known as CyberAssist to help suppliers with cybersecurity compliance.

Cybersecurity Maturity Model Certification (CMMC)

DIB SCC CyberAssist

Guidance on DoD Cyber Requirements

Civil

cyber security requirement for Civil Suppliers

Civil

Additional requirements and best practices for Civil Suppliers:

An NPA concerning the Management of Information Security Risks (NPA 2019-07) will affect all aeronautical information systems used within civil aviation. EASA will issue a non-binding compliance standard known as an Acceptable Means of Compliance (AMC) to enable suppliers to fulfil these new requirements.
If you deal with or are certified to the following, CS-23, CS-25, CS-27, CS-29, CS-E, CS-ETSO, CS-P, Notices of Proposed Amendments (NPA) concerning Aircraft Cyber-Security requirements (NPA 2019-01) will affect you. An AMC document is available for you to follow.

NPA 2019-01 - Aircraft Cyber-Security

NPA 2019-07 - The Management of Information Security Risks

UK Defence

cyber security requirement for UK-based Suppliers

UK Defence

Additional requirements and best practices for UK Defence Suppliers:

The Defence Cyber Protection Partnership (DCPP) is a joint Ministry of Defence (MOD) and industry initiative to improve the protection of the Defence supply chain from the cyber threat. The DCPP has developed the Cyber Security Model (DEFCON 658) which provides steps UK Defence Suppliers can take to ensure they are protected appropriately from attack.
1. Determine cyber risk profile by completing risk assessment.
2. Depending on profile, comply with DefStan 05-138, CE or CE+.
3. Complete Supplier Assurance Questionnaire (SAQ) to demonstrate compliance.

Alternatives to this model as well as supplier flow down of requirements are detailed on the MOD site.
If your business creates, receives, stores, processes or handles MOD data:
- that is classified OFFICIAL-SENSITIVE (OS) or above, and/or
- are deemed as operating your business ‘offshore’ and create, receive, store, process or handle data classified as OFFICIAL

Cyber Security for Defence Suppliers (DefStan 05-138)

Defence Cyber Protection Partnership – Guidance

ISN 2016/05 Definition of MOD Identifiable Information

NCSC Cyber Essentials & Cyber Essentials Plus

Incident Reporting

To report a vulnerability, please follow the guidance issued within the accompanying Vulnerability Disclosure Policy.

If you identify, are notified of, or reasonably suspect a cybersecurity incident relating to services you provide to GorWay, you must notify your business point of contact and the GorWay Security Operations Centre (SOC). For more information on this process, please follow Section 1.7 of the GorWay Minimum Cyber Security Standard. The SOC will provide additional information as needed to address your concerns.

RESOURCE DOWNLOADS

GorWay Vulnerability Disclosure Policy

Report a Cyber Security Incident to GorWay SOC

Our cyber security team: Christine Maxwell

Christine Maxwell leads and oversees all aspects of GorWay's cyber security across the globe. Her team is responsible for delivering a range of operational, assurance and support services and oversees the Group's cyber security risk and cyber transformation programmes. Christine also works with divisional and programme teams to ensure that cyber security risk and compliance is being managed and that security is being embedded by design and to support cyber security being everyone's responsibility.

Christine joined GorWay in 2026. Formerly she was the Chief Information Security Officer (CISO) at UK Ministry of Defence and SSE and has also worked at RBS, BP and KPMG.

How we deliver

SERVICE

Site survey & oil analysis

Our engineers run on-site sampling and laboratory-grade analysis to baseline your operating conditions.

DESIGN

Tailored system engineering

Modular skid design matched to your flow rate, contamination class and footprint.

SUPPORT

Commissioning & lifecycle service

On-site commissioning, operator training, and a global spare-parts network.

Cyber Security

The Tools and Info You Need

Must-Read Cyber News

Assessing the Current Threat Landscape

Shining Stars

How are GorWay's suppliers battling cyber threats? Our "Shining Stars" — real-world examples of GorWay suppliers protecting their businesses and our supply chain — share insights from the frontline.

Stay in the know on cyber security at
GorWay.