Securing Vendors

Best practices and resources to help your organization address vendor security

Still need help securing vendors? See the bottom of this page for info about our vCISO Services consultation. 

Most organizations are in the midst of a decade-old shift to deeper integration with managed service providers, software-as-a-service tools, and other cloud-based software solutions.  But with that shift to reliance on vendors, attackers have a new target.  Attacks on IT managed service providers (MSPs) increased 185% in 2019 according to Crypsis, and MSPs are being called a “worrying new frontier” for ransomware. In a survey of 600 companies, 44% reported experiencing a vendor-caused breach. And in May 2020, a ransomware attack on Blackbaud, a widely used cloud services provider for nonprofits, had broad implications for thousands of organizations.  More recently, an advanced (likely nation state) supply chain attack on the software vendor SolarWinds has left thousands of organizations (and government entities) vulnerable.

Getting Started

  • Do you have an inventory of your most critical suppliers or vendors?
  • Does your inventory detail the type of information that the vendor has access to or holds for your organization?
  • Rank your vendor list in order of importance (based on level of access to data or holding sensitive company data).

Vendor Vetting

  • Look for vendor attestations as to their security standards (AICPA’s SOC1 & SOC2 ISO 27001/27018, CSA STAR, FedRamp, C5, TRUSTe, PrivacyShield, DPA, etc)
  • Consider a Third Party Risk Management software solution such as Third Party Trust.
  • The Shared Assessments Program’s Third Party Risk Management (TPRM) Framework is designed to provide guidance for organizations seeking to develop, optimize and/or manage Third Party Risk by incorporating a wide range of best practices into their risk management program. The Framework also provides guidance about how to implement meaningful incremental improvements in TPRM practice maturity in organizations where resources may be constrained.
  • Do your vendor contracts contain security related provisions (data breach notification, data handling, etc.)?  Discuss vendor contract provisions in a free one-hour consult with Beckage Law (you can request this by email the Risk & Response Team).

Vendor Breach Response

Looking for hands-on help with securing vendors? Our consults with blue-chip vendors can help. 

vCISO Services from Corvus aim to help organizations dig deeper into specific issues and find the right offering to meet their needs. The process begins with a free, no-risk consultation call to explore options. Any further services selected are offered at an exclusive discounted rate. 

Click here and fill out the form to get started, making sure to select "Cloud Security Configuration Consult"