Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Edge Ask The Experts

09:00 AM
John Pironti, President, IP Architects
John Pironti, President, IP Architects
Ask the Experts
Connect Directly

How Do I Get My Third-Party Suppliers to Meet My Security Standards?

Five security clauses to include in all of your supplier contracts.

Question: How do I get my third-party suppliers to meet my security standards?

John Pironti, president of IP ArchitectsSupplier contracts need to include clauses that give suppliers some parameters and incentives to implement appropriate security controls if they want to keep your business. Here are a few types of security clauses you should include in all supplier contracts. 

• Right to audit: To ensure suppliers are not only implementing but sustaining appropriate security measures, include language that lets you audit your suppliers either by yourself or through a mutually agreed upon third party.

• Verification of compliance: If you require your suppliers to be compliant to regulatory requirements (i.e., HIPAA, GLBA) or industry standards (i.e., ISO 27001, PCI), I recommend you contractually require them to demonstrate their compliance at least annually.

• Software maintenance and accountability: If a supplier is developing software for you, you need to know security deficiencies will be remediated at the supplier's cost within a reasonable time frame ("reasonable" based on the severity of the issue). Also, be sure to extend the covered time period to align with the expected useful life of the software being developed.  

• Disclosure of open source software components: Many software and hardware technology solutions are developed using open source components, and as vulnerabilities like Heartbleed and Shellshock first showed us, we cannot assume open source components are secure. If suppliers disclose an inventory of all open source components (including the version number and acquisition source), you'll know to respond when vulnerabilities are discovered.

• Flow down attestation: Vendors must know that you expect them to monitor the security of their vendors as well. Put explicit language in your supplier agreements that requires appropriate security controls be in place for any supplier that can interact with your information infrastructure or data assets.

What do you advise? Let us know in the Comments section, below.

John P. Pironti is the President of IP Architects LLC. He has designed and implemented enterprise-wide electronic business solutions, information security and risk management strategies and programs, enterprise resilience capabilities, and threat and vulnerability management ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Threaded  |  Newest First  |  Oldest First
User Rank: Ninja
7/9/2019 | 10:34:09 AM
Great Post
I do think that "Continuous Monitoring" needs to be something we need to implement. By doing so, the user puts together a dashboard where the risks are shared amongst the group (read-only and isolated to that group of companies). If any issues come up, then it is open for everyone to see, similar to way Extrahop security module or Nessus/Snort Enterprise Dashboard gives users the ability to determine if there are flaws, vulnerabilities, threats on the floor.

Cartoon Caption Winner: Be Careful Who You Trust
Flash Poll