登录查看更多内容

What is the best way to align vendor contracts with your organization's cybersecurity requirements?

由人工智能和领英社区提供技术支持

Vendor contracts are essential for outsourcing some of your business functions, but they also pose cybersecurity risks if not aligned with your organization's requirements. How can you ensure that your vendors comply with your security policies, standards, and best practices? Here are some tips to help you align vendor contracts with your cybersecurity requirements.

此文章中的业界达人

由社区从 7 条内容中精选。了解更多

1 Assess your vendor's security posture

Before signing a contract with a vendor, you need to evaluate their security posture and capabilities. You can use various methods, such as questionnaires, audits, certifications, or third-party reviews, to assess how well they protect their data, systems, and networks. You should also verify that they have a security incident response plan and a business continuity plan in place.

添加您的观点

Anthony Pangilinan

Versatile and Experienced Cyber Security Leader
举报内容
When leveraging independent third party audit reports, take into consideration the control environment of your own company to determine which ones the supplier will be operating on your behalf. The purpose of third party reports and certifications is to gain a level of comfort that the supplier meets or exceeds your own level of security.

已翻译

赞
Juan Luis Nú?ez

Supervisor Arquitectura Empresarial en Banco de Costa Rica
举报内容
Importante de recordar, que en el cartel de términos, previo a la contratación se haya indicado como requisitos obligatorios los aquí indicados, para que luego puedan ser considerados parte del contrato, incluso como criterios de aceptación o terminación del contrato.

已翻译

赞

2 Define your security expectations and obligations

Your vendor contract should clearly define your security expectations and obligations for both parties. You should specify the scope, frequency, and standards of security testing, monitoring, and reporting that the vendor must perform. You should also outline the security roles and responsibilities of each party, such as who is accountable for data protection, encryption, backup, access control, and patching. Additionally, you should include clauses that address security breaches, liability, indemnification, and termination.

添加您的观点

Anthony Pangilinan

Versatile and Experienced Cyber Security Leader
举报内容
Develop a shared responsibility matrix that codifies what the supplier does versus what the company does as it can impact the company’s security posture in a negative fashion. The application of controls becomes more complicated when it is a cloud service provider and is dependent upon what type of service is being provided (IaaS, PaaS, SaaS). Appropriate service level agreements (SLAs) need to be clearly defined in order for a company to understand if there is a material breach of a contract.

已翻译

赞
Juan Luis Nú?ez

Supervisor Arquitectura Empresarial en Banco de Costa Rica
举报内容
Es algo esperable para contratos de servicios en sitio, pero que tiende a complicarse si se trata de servicios en la nube, en particular de grandes proveedores a los cuales se hace difícil obligar a ciertas condiciones, pero que por otra parte se espera que sean referentes del mercado y por ende cumplan con las mejores prácticas de ciberseguridad.

已翻译

赞

3 Align your security policies and processes

Your vendor contract should also align your security policies and processes with the vendor's. You should review and update your security policies and processes to reflect the vendor relationship and the data and services involved. You should also ensure that the vendor follows your policies and processes, such as data classification, retention, disposal, and transfer. Furthermore, you should establish a communication and escalation process for security issues and incidents.

添加您的观点

Juan Luis Nú?ez

Supervisor Arquitectura Empresarial en Banco de Costa Rica
举报内容
Sin duda las políticas y procedimientos de seguridad de una empresa deben ser revisados con frecuencia, al menos una vez al a?o. Sin embargo, el alineamiento con proveedores no debe conducir a un debilitamiento de los controles de seguridad de la organización, sino al contrario.

已翻译

赞

4 Monitor and review your vendor's performance

Your vendor contract should not be a one-time deal. You should monitor and review your vendor's performance regularly to ensure that they meet your security requirements and expectations. You should use metrics and indicators to measure their security performance, such as compliance rate, incident frequency, resolution time, and customer satisfaction. You should also conduct periodic audits and assessments to verify their security posture and practices. Moreover, you should provide feedback and guidance to help them improve their security performance.

添加您的观点

Juan Luis Nú?ez

Supervisor Arquitectura Empresarial en Banco de Costa Rica
举报内容
También se debe considerar la revisión y cumplimiento de leyes y normas de acatamiento obligatorio de parte de los proveedores, respecto del personal encargado de la ejecución del contrato. Siempre el eslabón más débil es la persona y de ahí la importancia de una adecuada gestión por parte del proveedor, así como una supervisión estricta por parte de la empresa, procurando mantener una independencia y distanciamiento saludables, para evitar conflictos de interés.

已翻译

赞

5 Update your vendor contract as needed

Your vendor contract should be flexible and adaptable to changing security needs and challenges. You should update your vendor contract as needed to reflect any changes in your security requirements, expectations, or obligations. You should also review your vendor contract periodically to ensure that it is still relevant and effective. Additionally, you should negotiate and document any changes or amendments to your vendor contract in writing.

添加您的观点

6 Manage your vendor relationships

Your vendor contract should be part of a broader vendor management strategy that aims to build and maintain trust and collaboration with your vendors. You should manage your vendor relationships proactively and strategically, not just reactively and tactically. You should communicate with your vendors regularly and transparently, share your security goals and challenges, and align your interests and incentives. You should also recognize and reward your vendors for their security performance and contributions.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Brian Neuhaus

Cybersecurity Leader & CISO driving innovation at Neuhaus Ventures | Servant leader to making this planet a safer place
举报内容
There are many products available to continually assess a vendors security posture, specifically that external threat surface. Though this isn’t the only metric but a good indicator of security practices at large. Examples: Bitsight, Security Scorecard

已翻译

赞

Vendor Management

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What is the best way to align vendor contracts with your organization's cybersecurity requirements?

1

2

3

4

5

6

7

1 Assess your vendor's security posture

2 Define your security expectations and obligations

3 Align your security policies and processes

4 Monitor and review your vendor's performance

5 Update your vendor contract as needed

6 Manage your vendor relationships

7 Here’s what else to consider

Vendor Management

给文章评分

感谢您的反馈

更多Vendor Management相关文章

更多相关阅读内容

What is the best way to align vendor contracts with your organization's cybersecurity requirements?

1

2

3

4

5

6

7

1 Assess your vendor's security posture

2 Define your security expectations and obligations

3 Align your security policies and processes

4 Monitor and review your vendor's performance

5 Update your vendor contract as needed

6 Manage your vendor relationships

7 Here’s what else to consider

Vendor Management

给文章评分

感谢您的反馈

查看其他技能