Best Practices for Securing Vendors

Key factors in securing vendors

Most organizations are in the midst of a decade-old shift to deeper integration with managed service providers, software-as-a-service tools, and other cloud-based software solutions. But with that shift to reliance on vendors, attackers have a new target. Attacks on IT managed service providers (MSPs) increased 185% in 2019 according to Crypsis, and MSPs are being called a “worrying new frontier” for ransomware. In a survey of 600 companies, 44% reported experiencing a vendor-caused breach. And in May 2020, a ransomware attack on Blackbaud, a widely used cloud services provider for nonprofits, had broad implications for thousands of organizations. More recently, an advanced (likely nation-state) supply chain attack on the software vendor SolarWinds has left thousands of organizations (and government entities) vulnerable.

Getting started

• Do you have an inventory of your most critical suppliers or vendors?
• Does your inventory detail the type of information that the vendor has access to or holds for your organization?
• Rank your vendor list in order of importance (based on level of access to data or holding sensitive company data).

Vendor vetting

• Look for vendor attestations as to their security standards (AICPA’s SOC1 & SOC2 ISO 27001/27018, CSA STAR, FedRamp, C5, TRUSTe, PrivacyShield, DPA, etc).
• Consider a Third-Party Risk Management software solution such as Third-Party Trust.
• The Shared Assessments Program’s Third-Party Risk Management (TPRM) Framework is designed to provide guidance for organizations seeking to develop, optimize and/or manage Third Party Risk by incorporating a wide range of best practices into their risk management program.
  • The Framework also provides guidance about how to implement meaningful incremental improvements in TPRM practice maturity in organizations where resources may be constrained.
• Do your vendor contracts contain security-related provisions (data breach notification, data handling, etc.)?
  • Discuss vendor contract provisions in a free one-hour consult with Beckage Law (you can request this by emailing the Risk & Response Team).