As the saying goes, you can outsource most anything, but you can’t outsource responsibility. Companies remain on the hook for ensuring their vendors are up to task when it comes to cybersecurity, privacy compliance and continuity of operations. This checklist can help determine the maturity of your vendor risk management program.
✔ We understand the vendor’s role relative to our business risk.
Knowing if a vendor is reliable requires knowing how they are being relied upon. It is worth considering how a particular vendor’s security failure might impact the confidentiality, integrity or availability of your employee records, customer data and business secrets, and whether their failure could put a halt to your operations altogether.
✔ We understand the vendor’s security relative to our requirements.
Just because a vendor is well known, does not mean their standard offering meets your company’s legal, regulatory, contractual and business security needs. Companies often take advantage of a cross-functional team of information security, legal, compliance, procurement, privacy and risk experts when making important vendor decisions.
✔ We ask the right questions and understand the response.
Vendor questionnaires are all the rage, but they are resource intensive for both parties. If your company uses them, do it right by assigning appropriate personnel to assess the answers, recognize gaps and potential remediation measures, follow your organization’s risk acceptance procedures and document decisions. Alternatively, consider accepting independent third-party audits and certifications, supplemented only as necessary for unique requirements.
✔ Our contracts are rock solid.
The Federal Trade Commission put it succinctly: “Insist that appropriate security standards are part of your contracts.” But, what are appropriate standards? Among other things, strong contracts take into account a company’s legal and regulatory environment, and often have provisions relating to specific security controls, compliance with industry standards, third-party certifications, data rights and privacy requirements, audit rights, insurance coverage, incident notification (and cooperation and information sharing if there is an incident), responses to legally compelled disclosure, data localization requirements, choice of law, restrictions on subcontracting, data destruction, SLAs and indemnification.
✔ We understand our shared responsibilities.
The fact that your vendor’s product or service complies with certain standards does not mean that your use of that offering remains compliant with the very same standards. This especially holds true for data centers. Compare it to a construction site. Just because the land is zoned properly does not mean the structure placed on it will pass inspection.
✔ We assess, and periodically reassess, vendor compliance.
As stated by the FTC, “Security can’t be a ‘take our word for it’ thing.” Companies are responsible for determining that a vendor actually is implementing its contractual requirements throughout the life of the contract.
As a closing thought, outsourcing remains on the rise, which makes vendor management an increasingly important part of enterprise risk. If your organization currently lacks the expertise to get through this checklist, you can always hire somebody to help. Please just be sure to vet them first.
