Vendor Risk Management: Ten Frequently Asked Questions

Email     |     Share  
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12
Next Vendor Risk Management: Ten Frequently Asked Questions-5 Next

Legal

How much will I need to work with our legal counsel to develop a program? Aren't my vendors legally obligated to share security information will me?

One of your legal team's main priorities will be to establish a disclosure obligation with your vendors. Pretend once more that you are Coca-Cola. If your vendor is breached and they lose customer data or other sensitive information, there are laws in place to protect the customer – in other words, you are legally required to tell a customer if their information – like their credit card number – has been compromised. But what happens if one of your vendors is breached and Diet Coke's secret formula has been compromised? Are they legally bound to tell you, Coca-Cola? No; unless they have a legal obligation to do so, that is.

So, you can see how important it is to have your legal team intimately involved in the VRM process. You need to be sure that your vendors are legally bound to inform you if an incident that affects your security position takes place. You are also able to tell your vendors how secure you want your data through your contracts. And, if they don't comply, you'll be able to take legal action against them.

As cyber threats become more sophisticated and complex, businesses need not only to ensure they are secure, but that their vital partners, suppliers and vendors are protecting themselves as well. According to the 2015 Verizon DBIR, 70 percent of observed cyber attacks involved a secondary victim. To avoid being blindsided, organizations are beginning to monitor the security of their third parties to reduce the likelihood of a data breach.

Gartner estimates that around 10 percent of companies have formalized IT risk management programs, but that the figure will grow to 40 percent by 2018. If you're just beginning to implement a vendor risk management (VRM) program, BitSight Technologies has identified 10 frequently asked questions to help you get started.

 

Related Topics : Unisys, Stimulus Package, Security Breaches, Symantec, Electronic Surveillance

 
More Slideshows

IT security careers The Most In-Demand Security Jobs and How to Get Them

Security professionals are in demand right now, and entry-level security jobs generally fall into either an engineer or analyst role. Find out more about required skills and career paths. ...  More >>

142x105itbeusasecurity2.jpg 9 Predictions for Cybersecurity’s Role in Government and Politics in 2017

Experts predict how cybersecurity will affect and involve our government, policies and politics in 2017. ...  More >>

Shadow IT Security How Risky Behaviors Hurt Shadow IT Security

Examine some of the concerns involving shadow IT security and some of the riskiest behaviors, applications and devices. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.