Preplanning is the key to managing or avoiding a cyber incident. There are many ways to clean up your house internally and many ways to assess and plan for possible exposure. Preplanning is not just about your own internal practices, however: it's also about ensuring that your suppliers are managing their practices to your standards. Establishing your own “best practices” and policies is important to risk assessment and mitigation and to a defense based on the use of reasonable measures of protection. That effort may lose some effectiveness, however, if you fail to hold others to your standards when they are performing work for you. What follows are some basics to consider when evaluating your vendors and their commitments to your cybersecurity, as well as some specific measures to employ with those suppliers whose work might present a risk to your company data.

What Vendors Present a Risk?

The presence of any third party in your business creates potential risk. Their employees and contractors are not subject to your policies directly; they may work with minimal supervision; and they may have to have access to otherwise-restricted equipment, areas or system. Containing any exposure starts with assessing the risks.

As a baseline, it is important to consider what kinds of third-party work may have direct implications for your network and data security. Obvious choices for any business include IT workers, software licensors, providers of cloud-based services (such as HR or other portals) and consultants whose role includes business continuity or disaster recovery. Such service providers will have direct access to, or the opportunity for direct access to, your sensitive internal data. Depending on your industry, you might also have other types of service providers whose work implicates your proprietary data. Examples include payment card processors for retail businesses, e-mail marketing list managers, fleet or sales force management providers who track various elements of your workflow and workers, and more. Any provider with direct access to your confidential data should be considered.