登录查看更多内容

What do you do if your IT outsourcing partner fails to meet security standards?

由人工智能和领英社区提供技术支持

When you entrust your IT needs to an outsourcing partner, you expect them to uphold the highest security standards. However, if you find that your partner is not meeting these critical requirements, it can put your operations and data at risk. It's essential to take immediate and decisive action to address any security shortcomings and ensure the protection of your sensitive information. In this article, you'll learn the steps you should take if your IT outsourcing partner fails to meet security standards.

此文章中的业界达人

由社区从 7 条内容中精选。了解更多

Dik Turpin González Jiménez

CTO - Director General Adjunto de Tecnologías de la Información en Fundación Dondé Banco
Murali Raghunathan

Principal Reservoir Engineer ; Industrial Adjunt/Fellow - Heriot Watt University Malaysia Technical Mentoring
Keith Daser

Founder @ Deliver Digital | Host of Sell Me This Podcast | Helping you get more from your technology partnerships

1 Assess Risks

Once you suspect a security standard breach, promptly assess the risks to your organization. This involves identifying the specific areas where the outsourcing partner is falling short and understanding the potential impact on your data and systems. You need to evaluate the severity of the breach and determine if there are any immediate threats to your operations. This risk assessment will guide your subsequent actions and help prioritize issues that need urgent attention.

添加您的观点

Dik Turpin González Jiménez

CTO - Director General Adjunto de Tecnologías de la Información en Fundación Dondé Banco
举报内容
Implementa medidas de contención y remediación basadas en la brecha de incumplimiento y en el riesgo detectado. Garantiza un monitoreo adecuado hasta alcanzar el cumplimiento. Algunas acciones para prevenir o corregir: 1. Establece un marco para la evaluación de proveedores y asegura una selección apropiada. (Incluye un plan alternativo) 2. Desarrolla un contrato detallado con cláusulas para el manejo de incumplimiento y correcto funcionamiento del servicio, incluye SLAs, penalizaciones, KPIs, etc. 3. Implementa estrategias de contingencia y continuidad del servicio. 4. Realiza monitoreo y evaluación constante del cumplimiento, e incluye auditorías externas. 5. Promueve la mejora continua y la revisión periódica de procesos.

已翻译

赞
Murali Raghunathan

Principal Reservoir Engineer ; Industrial Adjunt/Fellow - Heriot Watt University Malaysia Technical Mentoring
举报内容
Simple.... compromise on security cannot be tolerated. Penalty or temination clause on breach of such security parameters should be embedded in the contract. We should have means to measure or count the breaches... prove the point and terminate. "You can't pay for the leaking tap - specially when it is intended not to"

已翻译

赞
T.J. Boone

AI Business Strategist | Bridging Business & AI Technology | Founder, SunStream AI
举报内容
1. Review the contract: Carefully review the contract or service-level agreement (SLA) you have with the outsourcing partner. Check if there are any clauses or provisions related to security requirements, compliance standards, and penalties for non-compliance. 2. Communicate concerns 3. Conduct a risk assessment 4. Implement compensating controls 5. Request an independent audit 6. Escalate the issue 7. Terminate the contract

已翻译

赞
Gangesh Thakur

Head of ERP (SAP) Platform at Alstom I Digital Transformation and Operations Leader I Ex-EY, HP, IBM, Accenture, HCL and Hindalco I Artificial Intelligence Evangelist - #StudentForLife
举报内容
Define hard and soft KPIs within contract. for hard kpis, there needs to be strong penalty e.g. security breach, financial impact etc. review the contract in case KPIs not defined correctly and have transparent discussion with partner to prevent such topics.

已翻译

赞
Dr. Dirk Koetting

?? Dr. Dirk Koetting – Strategischer KI- & IT-Sparringspartner für CIOs & IT-Führungskr?fte | KI-Strategie, M&A-IT-Integration & Compliance | Wissenschaftlich fundiert, praxisnah & messbar
举报内容
This should not happen, a check when selecting the partner in the context of an ISO27001:2022 certification (scope), fulfil the BSI and, if necessary, the KRITIS, NIS 2 EU requirements. Analogous to what colleagues have written, these topics should be clearly documented in the contract (SLAs, KPIs), which have monetary consequences in the event of non-compliance.

已翻译

赞

2 Communicate Concerns

After identifying the risks, the next step is to communicate your concerns to the outsourcing partner. It's crucial to do this constructively, providing clear examples of where they are not meeting the agreed-upon security standards. Ensure that this communication is documented for future reference. It's also important to discuss the potential consequences of these security lapses and to express your expectations for how they should address the situation.

添加您的观点

Prakash Somani

VP Services Offering | Global Delivery Head | Business Head | Practice Head | IT Transformation Services Head | P & L Leader | IT Consulting leader | Alliance Leader | Ex-IBM, Ex- Infosys, Ex-Cognizant, Ex-Wipro
举报内容
Communication also include: 1. Consequence for this and future incident 2. A formal review / third party review and certification 3. Process, people and Technology gaps and addressing gaps. 4. Legal notice

已翻译

赞

3 Review Contract

Your contract with the IT outsourcing partner should outline the security standards and protocols that must be adhered to. Review this document carefully to understand your legal standing and any provisions for non-compliance. The contract may include clauses that specify corrective measures or penalties in the event of a security breach. This review will help you understand your options and the process for enforcing compliance.

添加您的观点

4 Implement Changes

Depending on the gravity of the situation, you might need to implement immediate changes to safeguard your information. This could involve restricting the outsourcing partner's access to certain systems or data until they have rectified the security issues. You may also need to enhance your own security measures internally or consider alternative solutions for the services provided by the partner.

添加您的观点

5 Monitor Progress

After changes have been agreed upon, it's vital to monitor the progress of your IT outsourcing partner in addressing the security concerns. Set up regular check-ins and request updates on their efforts to improve security practices. This ongoing oversight will help ensure that they are taking your concerns seriously and making the necessary improvements.

添加您的观点

6 Plan for Future

Finally, use this experience as a learning opportunity to better prepare for the future. Consider implementing stronger vetting processes for IT outsourcing partners, including detailed security standards in contracts, and establishing more rigorous monitoring protocols. By doing so, you can help prevent similar situations from arising and maintain a secure IT environment for your organization.

添加您的观点

7 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?

添加您的观点

Keith Daser

Founder @ Deliver Digital | Host of Sell Me This Podcast | Helping you get more from your technology partnerships
举报内容
Security is paramount and must be of the utmost importance for all IT outsourcing agreements. If your partners are misaligned on the importance of security that is a giant red flag and it is probably time to switch partners. Although controls can be added and changes can be made, if there is a misalignment in the importance, it would be tough for a partnership to overcome.

已翻译

赞

IT Outsourcing

+ 关注

给文章评分

我们借助人工智能创建了此文章。您认为这篇文章怎么样？

很棒不太好

举报此文章

查看全部

What do you do if your IT outsourcing partner fails to meet security standards?

1

2

3

4

5

6

7

1 Assess Risks

2 Communicate Concerns

3 Review Contract

4 Implement Changes

5 Monitor Progress

6 Plan for Future

7 Here’s what else to consider

IT Outsourcing

给文章评分

感谢您的反馈

更多IT Outsourcing相关文章

更多相关阅读内容

What do you do if your IT outsourcing partner fails to meet security standards?

1

2

3

4

5

6

7

1 Assess Risks

2 Communicate Concerns

3 Review Contract

4 Implement Changes

5 Monitor Progress

6 Plan for Future

7 Here’s what else to consider

IT Outsourcing

给文章评分

感谢您的反馈

查看其他技能