Today’s organizations rely on a growing network of vendors, suppliers, technology providers and other third parties to keep their operations running. While these relationships can improve efficiency and support business growth, they can also introduce cybersecurity risks that may be outside of your direct control.
A cyber incident involving a vendor or supplier can potentially affect your organization’s systems, data, operations and ability to serve customers. As supply chains become increasingly connected, managing third-party cyber risk should be an important part of an organization’s broader cybersecurity and risk management strategy.
By understanding where potential exposures exist and establishing thoughtful processes for evaluating vendors, businesses can take steps to better manage cyber risk throughout their supply chain.
Start With Your Supply Chain
Cyber risks can exist at multiple points throughout a supply chain. Before an organization can effectively manage those risks, it should understand where its dependencies and potential exposures are.
Consider reviewing your supply chain to identify:
- Vendors and suppliers that have access to company systems or sensitive information
- The types of data shared with each third party
- Where data is stored and how long it is retained
- Who within each organization has access to shared information
- Whether vendors rely on subcontractors or other third parties
- Critical suppliers whose disruption could affect your operations
Many organizations work with more third parties than they realize. Developing a clear inventory of vendors and their access to systems and information can provide a useful starting point for assessing cyber exposures.
Organizations should also consider establishing cybersecurity expectations for vendors based on the level of risk involved. Not every vendor presents the same exposure, so requirements may need to reflect the services provided, the information accessed and the potential impact of a disruption.
Understand Your Cloud and Technology Exposures
Cloud-based applications and technology platforms have become an important part of many organizations’ operations. These services can offer flexibility and efficiency, but they also require businesses to understand how their information is being managed and protected.
When working with a cloud or technology provider, consider asking questions such as:
- Where is our data stored?
- Who can access our information?
- What security controls are in place?
- How frequently is data backed up?
- What happens to our information when the business relationship ends?
- How will the provider respond to a security incident?
Using a third-party technology provider does not necessarily eliminate an organization’s responsibility for managing its own cyber risk. Security responsibilities may be shared between the organization and its provider, depending on the services involved and the terms of the agreement.
Businesses should review vendor agreements and understand which party is responsible for specific security measures, incident response activities and potential costs following a cyber event.
Establish a Process for Evaluating Vendors
Vendor due diligence can help organizations better understand the cybersecurity practices of companies they work with.
A cybersecurity questionnaire may be one useful part of the evaluation process. Depending on the nature of the vendor relationship and level of risk involved, organizations may consider requesting information about:
- Data security and access controls
- Backup and recovery practices
- Incident response procedures
- Employee cybersecurity training
- Use of subcontractors
- Security monitoring and testing
- History of significant cybersecurity incidents
However, a questionnaire alone may not provide a complete picture of a vendor’s cybersecurity posture.
Cybersecurity risks and threats can change over time, and the information provided in a questionnaire represents only a point-in-time assessment. Organizations may benefit from periodically reviewing high-risk vendors and updating their due diligence processes as relationships, technologies and threats evolve.
Depending on the organization’s needs, third-party cybersecurity monitoring or risk-rating tools may also provide additional visibility into potential vulnerabilities and emerging concerns.
Review Contracts and Understand Potential Liability
Contracts are an important part of managing third-party relationships, but contractual language alone may not eliminate the financial and operational impact of a cyber incident.
A vendor may accept responsibility for certain losses in an agreement, but its ability to meet those obligations following a significant cyber event could depend on its financial resources and insurance coverage. Additional complexity may arise when vendors operate in different jurisdictions or rely on subcontractors that are not directly covered by the original agreement.
Organizations should consider reviewing vendor contracts to better understand:
- Each party’s cybersecurity responsibilities
- Data protection requirements
- Notification expectations following a cyber incident
- Liability limitations
- Indemnification provisions
- Requirements for subcontractors
- Cyber insurance requirements
It is also important to recognize when a vendor is essential to your operations. If replacing a critical supplier would be difficult or time-consuming, a cyber incident involving that vendor could create a significant business interruption exposure.
Prepare for a Cyber Event
No cybersecurity program can eliminate every potential threat. A well-developed response and recovery strategy can help organizations prepare for the operational challenges that may follow a cyber incident.
Consider developing and regularly reviewing:
- Cyber incident response procedures
- Business continuity plans
- Disaster recovery strategies
- Data backup and restoration processes
- Communication plans for employees, customers and other stakeholders
- Procedures for responding to a cyber incident involving a critical vendor
Testing these plans can also help organizations identify gaps before an actual event occurs.
Consider the Role of Insurance
Cyber liability insurance cannot prevent a cyberattack, but it can be an important component of a broader risk management strategy.
Depending on the policy and circumstances of a loss, cyber insurance may help address certain costs associated with a cyber event, such as incident response services, legal expenses, data breach notification and other covered losses.
Organizations may also want to evaluate their potential exposure to disruptions involving critical vendors or suppliers. Depending on the circumstances and available coverage, certain insurance policies may help address financial losses resulting from a disruption involving a third party.
Because coverage terms, conditions and exclusions can vary, it is important to review your organization’s specific exposures and insurance program.
Managing Third-Party Cyber Risk
As organizations become more connected to vendors, suppliers and technology providers, cybersecurity risk management must extend beyond internal systems.
Understanding your supply chain, evaluating critical vendors, establishing cybersecurity expectations and preparing for potential disruptions can help your organization take a more informed approach to managing third-party cyber risk.
At Bender Insurance Solutions, we work with organizations to identify and better understand emerging risks that may affect their operations. We can help you review your cyber insurance program, evaluate potential supply chain exposures and consider risk management strategies that support your organization’s broader business objectives.
This article is intended for informational purposes only and should not be interpreted as insurance, legal, or risk management advice.
