Why Your Vendors’ IT Security Is Actually Your Business

The Trojan Horse didn’t succeed because the Grecian armies broke down the walls of Troy; it succeeded because the Trojans fell for the Greek army’s trick and brought the secret war machine—with a small group of Greek soldiers—inside their walls. It was a tactically brilliant plan, and ended what was reportedly a decade-long siege in a matter of hours. 

Whether or not the original story is based in truth, your business is potentially in danger from a similar issue: a threat coming in on what seems to be a trustworthy package. The difference is that this time, the package is a platform or tool you’ve procured from a third-party vendor.

Third-party risks are effectively weaknesses that originate from a company you work with, not dissimilar to someone losing the spare key you gave them to housesit on your behalf. These risks are often the root cause of various data breaches, and so must be minimized for the sake of your business’ security posture.

So… how does one do that? Simple: a third-party risk assessment

What is a Third-Party Risk Assessment?

In essence, a third-party risk assessment is a background check of your vendor to ensure they are as committed to maintaining cybersecurity as you should be. During this check, you should focus on a few overarching topics:

• Data Handling: How is your business’ data stored and protected while in that vendor’s care?
• Access Control: How limited is the number of that vendor’s team members who can see the data you’ve entrusted to them?
• Redundancy: How vulnerable is your business to an operational issue on the vendor’s end?

Why You Need to Know This About Your Vendors

Let’s say you work with ACME for your payment processing needs. If ACME loses your customers’ financial details…say, credit card info…who do you think your customers and regulatory officials are going to point fingers at first?

Outsourcing can be fantastic—there’s a reason we work as outsourced IT providers here at White Mountain IT Services, after all—but it isn’t because handing off a task also allows you to hand off responsibility, too. You need to treat your vendors as an extension of your business when it comes to data security, just as you would if one of your services were delayed by them. It may be their fault, but you’re the one your clients, customers, and officials will blame.

Plus, these kinds of breaches will still leave you holding an extremely expensive bill.

How to Properly Manage Your Vendors

Fortunately, once you’ve found and assessed vendors you feel good working with, it’s relatively easy to keep them accountable without overwhelming yourself with additional responsibilities. For instance:

Remember that Different Vendors will Possess Different Data

Based on the need they fulfill, your assorted vendors will have varying levels of data they require to provide their services. This means that different vendors will carry different inherent risks. While a janitorial service will likely have your financial information in order to collect payments, a customer relationship management provider or outsourced human resource department will have that, plus that of your clients or staff. 

As such, some vendors should be required to meet higher benchmarks than others.

Ask for Confirmation

Any vendor you consider working with should have no trouble proving they are trustworthy. Ask to see the evidence of any audits they have had completed. If they can’t or won’t share this information, you may find it best to take your needs elsewhere.

Make Sure You Can Ask these Questions

After you’ve signed a contract, you need to be sure that there aren’t any stipulations that preclude you from investigating and auditing your vendors. If there are, you need to—at a minimum—go back to the negotiation table.

We’re Here to Watch the Watchmen, Among Other Things

We’re prepared to help you ensure your business has relationships with trustworthy vendors who consistently deliver on their promises. Not only do we have relationships with various providers and can help facilitate a business relationship with them, but we’re also keeping an eye on them to ensure their protections don’t slip. We’re here to help keep them accountable for the services they provide, as well as ours.

Any vendor relationship you establish—including and especially regarding your essential technology—should empower your business.

Again, we’re here to help ensure your IT vendors and business associates remain an asset, along with the rest of your information technology. Find out more by calling (603) 889-0800.