Vendor and Third-Party Management, we take your security to the next level, by introducing policies and controls.
Vendor and Third-Party Management
Supply Chain and Vendor and Third-Party Management
Agreements with suppliers should include requirements to address the information security risks associated with information and communications technology services and product supply chains.
CyberSecOp Vendor and Third-Party Management help businesses drive efficiency and cost savings, but they also pose complex, ever-evolving risks. The CyberSecOp team can help strengthen TPRM programs or functions, systems and technologies, assess third parties’ controls, and manage the risk of your third-party population.
Third-party risk management (TPRM) consulting services
Supplier agreements, specifically related to their use of technology, both hardware and software. There should be a process to identify a product or service that is a critical capability, and require increased scrutiny. This is especially true for components built outside the supplier organization. The ability to trace origins and compliance with security requirements is integral in ensuring both integrity and availability. Finally, the organization should address the risks of a component or service becoming unavailable or no longer supported.
Supplier Service Delivery Management
Objective: Supplier agreements should be established and documented to ensure there is no misunderstanding regarding both parties' obligations to fulfill relevant security requirements.
Once operations of service providers have started, ensuring that the services delivered conform to the specifications of third-party contracts is important. This can include everything from availability levels of the service to something more granular, such as examining the security controls the service provider agreed to in the contract. If there is a great level of dependency upon third-party service providers, checking into service capabilities, plans for handling information security incidents or service disruptions, and business continuity testing may be warranted. Systematic monitoring and reviews of services and controls is also recommended, including scrutinizing service reports provided by the third-party to ensure the information is sufficient and relevant. As business or information technology requirements are modified, this may also require a change in the provision of third-party services, and procedures should be in place to handle any new requirements. Additionally, modifications may also call for a review of existing information security controls to ensure they are adequate.
Monitoring and Reviewing Supplier Services
Organizations should regularly monitor, review and audit supplier service delivery. Institutions can not overlook the need to manage the risk to their information assets that are accessed, processed, communicated to, or managed by external parties (partners, vendors, contractors, etc.). The service provider should be continuously monitored to assure that services provided are meeting the terms of the contract and security is maintained. There should be ongoing review of service reports, a process to address concerns and issues and periodic audits. This section also encompasses documentation and procedures for handling security incidents, including incident reporting, mitigation and subsequent reviews. Finally, service capability levels must be monitored to insure that the service provider continues to meet the contract terms and needs of the business. In addition to regular review and monitoring of the services provided, the contracting organization should:
Conduct audits of suppliers in conjunction with outside assessments
Require the supplier to promptly notify regarding security incidents
Provide regular audit trails and records for security events
Have a conflict resolution process that can be invoked if requirements are not met
Statement on Standards for Attestation Engagements
Some external parties provide independent audits based on the Statement on Standards for Attestation Engagements (SSAE) No. 16 (formerly SAS 70) which focuses on the design of controls and their operating effectiveness. When independent audit opinions are not available, institutions might choose to evaluate the risk themselves.
Monitoring can mean different things to different people. It can simply mean to assess, to watch, to keep track of, or to check, usually, with a special purpose. It does not mean or imply to verify or even to test. Actually, monitoring is more of a spectrum that ranges from just "keeping an eye" in the low end to requiring a site audit in the high end. Given the availability of resources at institutions of higher education, verification could be an impractical and significantly costly requirement if applied to all or most suppliers
Effective monitoring of suppliers
Effective monitoring of suppliers requires a process or methodology in place that defines the approach to take based on the risk of the supplier or engagement - activities should be more stringent and closer to the high end of the spectrum as risk increases or when exceptional situations warrant them. Institutional policy may refer to instances in which the sharing of sensitive data will result in a significant risk. Again, "significant" can mean a number of things but, ultimately, depends on the institution's risk management practices and risk tolerance (i.e., what is acceptable risk). Only in cases of very high risk or when exceptional situations may warrant it should supplier monitoring include a requirement to perform a site audit, or results of a Statement on Standards for Attestation Engagements (SSAE) No. 16 (formerly SAS 70) audit, or results of an audit performed by an independent auditor.
monitor compliance with agreement requirements
What should an institution do to monitor compliance with agreement requirements in most cases? Define the incremental risk to the institution when engaging a supplier as well as defining a due diligence process for mitigating those risks - third-party risk from remote access, data transmission and offsite storage.
During System / Application / Process Implementation
Identify the individual(s) responsible for monitoring the relationship with the supplier.
During project status meetings:
Assess and review status reports regarding progress made in the implementation of the security requirements included in the contract and/or statement of work.
Identify new areas or security requirements that may arise from changes in scope
If applicable, perform or request audit of vendor security practices and procedures and/or perform penetration test. It may be necessary to include a legal review by general counsel, as well.
During final test and prior to sign-off
Test system/application/process security functionality required in the contract
Review progress reports and determine if all security requirements included in the contract and/or statement of work were completed.
If applicable, perform application scan
Post Implementation
Follow up with system/application/process owner.
Require owner to perform a risk assessment based on policy (annual if high risk or mission critical and bi-annual for the rest)
Review with the owner the risk assessment results. Any concerns? Any problems? Any unknowns that need to be addressed with the vendor?
Follow up with the supplier. Access logs available? Any pending items resolved? Are things on their end as expected? Any owner concerns? Risk assessment identified deficiencies?
Based on risk (annually or bi-annually), resubmit third-party information security risk assessment to assess what has changed, what needs closer scrutiny, or identify inconsistencies with previous assessments
Establish a working relationship with your supplier
Participate in supplier’s product improvement committee. What changes are been considered? How would they impact the institution's risk and security postures
Review security incidents involving the system/application/process. Are these due to non-compliance?
If applicable, based on the contract, require subsequent assurance tests.
For current established suppliers, assess their risk (if it has not already been done), and start with the steps listed in the Post Implementation section above as needed.
It is important to keep in mind that supplier monitoring is the last step of a cascading progression. The initial identification of process and data impacted as well as initial security requirements are used to formulate purchasing requirements. The answers to the requirements are used to evaluate potential suppliers and refine the security requirements. The evaluation and risk assessment of finalists refine the security requirements that will, in turn, be added as language to the contract or statement of work. And, finally, it is the final contract and corresponding risk level that determine the appropriate supplier monitoring approach.
Managing Changes to Supplier Services
All technology systems are undergoing continuous upgrade, change and repair. Changes to service provisions by suppliers should be managed and documented, taking into account the sensitivity of information and services and re-assessment of risks. The contracting organization should determine how to integrate their change management process with that of the supplier. Items to consider include:
Service enhancements
Bug fixes
Use of new technology
New development tools
Enhanced security measures
Change of subcontractor
Change of physical sites
Where possible, supplier changes should be integrated with the contracting organizations change management processes.