How Do I Get My Third-Party Suppliers to Meet My Security Standards?

Question: How do I get my third-party suppliers to meet my security standards?

John Pironti, president of IP Architects: Supplier contracts need to include clauses that give suppliers some parameters and incentives to implement appropriate security controls if they want to keep your business. Here are a few types of security clauses you should include in all supplier contracts. 

• Right to audit: To ensure suppliers are not only implementing but sustaining appropriate security measures, include language that lets you audit your suppliers either by yourself or through a mutually agreed upon third party.

• Verification of compliance: If you require your suppliers to be compliant to regulatory requirements (i.e., HIPAA, GLBA) or industry standards (i.e., ISO 27001, PCI), I recommend you contractually require them to demonstrate their compliance at least annually.

• Software maintenance and accountability: If a supplier is developing software for you, you need to know security deficiencies will be remediated at the supplier's cost within a reasonable time frame ("reasonable" based on the severity of the issue). Also, be sure to extend the covered time period to align with the expected useful life of the software being developed.  

• Disclosure of open source software components: Many software and hardware technology solutions are developed using open source components, and as vulnerabilities like Heartbleed and Shellshock first showed us, we cannot assume open source components are secure. If suppliers disclose an inventory of all open source components (including the version number and acquisition source), you'll know to respond when vulnerabilities are discovered.

• Flow down attestation: Vendors must know that you expect them to monitor the security of their vendors as well. Put explicit language in your supplier agreements that requires appropriate security controls be in place for any supplier that can interact with your information infrastructure or data assets.

What do you advise? Let us know in the Comments section, below.