Cybersecurity Best Practices
      Back to home
      1. Knowledge Nest
      2. Cybersecurity Tips + Vulnerability Alerts
      3. Cybersecurity Best Practices

      Securing Vendors

      Best practices and resources to help your organization address vendor security

      Most organizations are in the midst of a decade-old shift to deeper integration with managed service providers, software-as-a-service tools, and other cloud-based software solutions.  But with that shift to reliance on vendors, attackers have a new target.  Attacks on IT managed service providers (MSPs) increased 185% in 2019 according to Crypsis, and MSPs are being called a “worrying new frontier” for ransomware. In a survey of 600 companies, 44% reported experiencing a vendor-caused breach. And in May 2020, a ransomware attack on Blackbaud, a widely used cloud services provider for nonprofits, had broad implications for thousands of organizations.  More recently, an advanced (likely nation state) supply chain attack on the software vendor SolarWinds has left thousands of organizations (and government entities) vulnerable.

      Getting Started

      • Do you have an inventory of your most critical suppliers or vendors?
      • Does your inventory detail the type of information that the vendor has access to or holds for your organization?
      • Rank your vendor list in order of importance (based on level of access to data or holding sensitive company data).

      Vendor Vetting

      • Look for vendor attestations as to their security standards (AICPA’s SOC1 & SOC2 ISO 27001/27018, CSA STAR, FedRamp, C5, TRUSTe, PrivacyShield, DPA, etc)
      • Consider a Third Party Risk Management software solution such as Third Party Trust.
      • The Shared Assessments Program’s Third Party Risk Management (TPRM) Framework is designed to provide guidance for organizations seeking to develop, optimize and/or manage Third Party Risk by incorporating a wide range of best practices into their risk management program. The Framework also provides guidance about how to implement meaningful incremental improvements in TPRM practice maturity in organizations where resources may be constrained.
      • Do your vendor contracts contain security related provisions (data breach notification, data handling, etc.)?  Discuss vendor contract provisions in a free one-hour consult with Beckage Law (you can request this by email the Risk & Response Team).

      Vendor Breach Response

      Looking for hands-on help with securing vendors? Our consults with blue-chip vendors can help. 

      Corvus policyholders can access support services through the Vendor Marketplace in their Policyholder Dashboard.

      Brokers, request a Security Controls Consult.