Tips for more secure software and data vendor agreements
How can IT teams ensure vendor contracts ensure best practices for data security.
Getty Images
How can IT teams ensure vendor contracts ensure best practices for data security.
Getty Images
While software and data vendors provide critical services and tools to organizations, their interactions with sensitive information can potentially make them a security risk. What should IT teams look for in vendor contracts to ensure best practices for data security?
According to Gary Brickhouse, CISO at GuidePoint Security, enterprises should hold vendors accountable for the actions taken in their environment: “The same way that you should have a risk-based approach about your controls and your environment, you should also have a risk-based approach to what your vendor is doing to you.”
While many vendors have contract requirements around data management and security, it’s also critical for IT teams to scrutinize a vendor’s access to critical databases and other systems, especially when it comes to a vendor handling their own partnerships and environment.
What to include in a contract. Gary Orenstein, CCO at Bitwarden, pointed to data protection policies as a bare-bones necessity for any contracted agreement between a vendor and organization.
“There’s a set of information security policies that most companies maintain, and a buyer will likely want to understand and see those security policies. A buyer will want to understand the details on data protection, and depending on the application, the encryption,” Orenstein said, pointing to end-to-end encryption as a prerequisite.
In the event of data leakage or a systems breach, businesses will also want to understand how a vendor communicates, as well as its incident response.
Brickhouse believes vendors should have a contractual obligation to notify customers about incidents, including free monitoring: “In my mind, in a perfect world, if you think about all the pieces that would be involved in the recovery aspect of an incident, you would want the contractual language to point to the vendor, to put them on the hook or obligated to provide those recovery services.”
For IT teams new to working with vendors on issues of privacy and data security, it’s worth asking if vendors handling an organization’s data follow SOC 2 and other frameworks.
Brickhouse said that enterprises should ensure vendors that touch critical IT infrastructure are aligned with some standard of data security.
Asking some questions. Some data and security questions Brickhouse suggested organizations might ask their vendors include:
