B2B (business to business)
B2B describes commercial relationships and transactions between companies. In security terms it is where one organisation’s controls stop being sufficient, because the data and the access are now shared with somebody else’s estate.
B2B, business to business, describes commercial relationships and transactions established between companies rather than between a company and an individual consumer.
In practice it means one organisation providing services to, exchanging information with, or trading goods with another, over systems that connect the two.
Security matters here for a specific reason, and it is not the obvious one. It is not that B2B data is more sensitive than consumer data, although it often is. It is that a B2B relationship extends the boundary: the confidentiality, integrity and availability of your data now depend partly on controls you do not operate and cannot see.
What it involves
Protecting shared data. B2B exchanges regularly involve financial information, commercial strategy and intellectual property. Protecting it means knowing what is being shared, with whom, and under what terms, which starts with data classification rather than with technology.
Authentication and access control. Because resources are shared, strong authentication and role based access matter more, not less. Multi-factor authentication on partner accounts is the single control that removes the largest class of incident, because a partner credential is exactly what gets phished and reused.
Secure communication. Email, messaging and direct system to system connections all carry the exchange, and all of them are targets. Encryption in transit is the baseline; recognising a well written fraudulent instruction is the harder part.
Identity and privacy. Personal data that moves between two companies still has an owner and a legal basis, and the agreement between the two is where the responsibilities are written down.
A worked example
Two companies collaborate on manufacturing and distributing electronic products.
Company A, which manufactures, needs to share designs and specifications with company B, which distributes and sells.
They exchange the material through a shared portal. Access is protected with multi-factor authentication, and access control policy limits which employees see which documents rather than granting everybody everything.
Traffic is encrypted, both organisations run controls against malware, and both agree on how personal data will be handled.
What the arrangement does not remove is the dependency. If company B is compromised, the designs are compromised, no matter how well company A is run.
Why the boundary is the interesting part
The security question a B2B relationship actually raises is not how to protect the portal. It is what happens when the other side is breached.
Partner and supplier access has been the route into a long list of significant incidents, because it is access that was legitimately granted, is often broad, and is rarely reviewed after the project that justified it ended. The pattern is consistent: an account created for an integration, given more permission than it needed, never revoked.
Three questions are worth asking of every B2B connection, and they are answerable without a tool. What exactly can this partner’s access reach. Who reviews it, and when did they last do it. And if this partner tells us tomorrow that they have been compromised, what do we do in the first hour.
The same logic applies to software rather than to people, where it becomes a supply chain attack, and to services, where the shared responsibility model is the written version of the same question.
Where to read more
CISA, Cybersecurity best practices: general guidance that covers third-party access and the controls that apply to it.