65 Ask questions during the request for proposal Ensure that the security practices of the (RFP) process to understand the security vendor / partner organization comply with posture and practices of the partner those of your own organization. Ensure that organization, and whether its offerings meet the purchased product / service meets your security requirements. Compare the security organization’s security requirements. policies and procedures of a third party against your organization’s own security policy to ensure compliance. 66 Identify and prioritize external dependencies, Having an understanding of the dependency both upstream (the organization depends on chain is critical in managing risk introduced whom?) and downstream (who depends on by third-party dependencies, in addition to the organization?). The organization should highlighting areas where additional pay special attention to critical dependencies; contingency planning may be required in for example, relying on a single external case a third party becomes unavailable. for a key function / service with no secondary party readily available as backup. Review the hiring practices and personnel Make sure that your vendor / partner 67 background checks of your vendors and organization’s background checks during the partners to ensure that they comply with your hiring process are consistent with your own. organization’s policies. Security issues at vendors translate into security issues in their products. 68 Ensure that service-level agreements (SLAs) A contractual obligation will help your and other contractual tools are properly organization transfer some of the security leveraged so that vendors and partners live up risks. to their obligations. For instance, if a breach occurs at a partner organization, there needs to be a provision to have your organization notified of the full extent of the breach as soon as the information is available.
65 Ask questions during the request for proposal (RFP) process to understand the security posture and practices of the partner organization, and whether its offerings meet security requirements. Compare the security policies and procedures of a third party against your organization’s own security policy to ensure compliance. Ensure that the security practices of the vendor / partner organization comply with those of your own organization. Ensure that the purchased product / service meets your organization’s security requirements. 66 Identify and prioritize external dependencies, both upstream (the organization depends on whom?) and downstream (who depends on the organization?). The organization should pay special attention to critical dependencies; for example, relying on a single external for a key function / service with no secondary party readily available as backup. Having an understanding of the dependency chain is critical in managing risk introduced by third-party dependencies, in addition to highlighting areas where additional contingency planning may be required in case a third party becomes unavailable. 67 Review the hiring practices and personnel background checks of your vendors and partners to ensure that they comply with your organization’s policies. Make sure that your vendor / partner organization’s background checks during the hiring process are consistent with your own. Security issues at vendors translate into security issues in their products. 68 Ensure that service-level agreements (SLAs) and other contractual tools are properly leveraged so that vendors and partners live up to their obligations. For instance, if a breach occurs at a partner organization, there needs to be a provision to have your organization notified of the full extent of the breach as soon as the information is available. A contractual obligation will help your organization transfer some of the security risks.
2014-Coop-Cyber-Security-Plan-Template-Update-1.docx