Strong information security is crucial to safeguarding your organization and customer data. Information security always keeps confidentiality, integrity and availability at the core. This means the following:
- Confidentiality: Preventing unauthorized disclosure of information
- Integrity: Ensuring that data isn’t modified in unauthorized means
- Availability: Ensuring that information is available when needed and only to authorized personnel
- Your third party vendor should have a well-developed information security policy that includes controls that address these key concepts. Equally as important as having a policy is validating that it has been implemented and is reviewed annually.
Top Requirements of Your Vendor’s Information Security Policy
Let’s delve further into the integral components of a vendor information security policy. A comprehensive information security policy should include the following:1. Confidentiality – To guarantee confidentiality, vendor communications channels and media must be properly monitored and controlled to prevent unauthorized access. Your vendor’s Information security policy should include steps for ensuring appropriate user logical access.
Logical access controls should include key concepts such as password requirements, the principle of least privilege and separation of duties. Here is some helpful guidance to obtain this:
- The principle of least privilege says that a user should only be able to access the resources needed to perform their defined role, such as only HR being able to access employee personal identifiable information (PII).
- Separation of duties says that a user should not be able to perform a task and also approve that the task was done properly. A common implementation of this is within a software change management program where developers should not be able to promote their code from a test environment to a production environment on their own.
- Password requirements should include configuration minimums such as length, character parameters, complexity requirements, etc.
2. Integrity –This means to ensure that data isn’t modified by unauthorized ways. To guarantee integrity, vendors should be able to demonstrate that they have controls in place to protect information from unauthorized modification. One way to do this is by ensuring proper input, processing and output controls are in place and documented within the vendor information security policy.
3. Availability – This is ensuring that information is available when needed and only to those authorized to have it. Vendors should be able to validate how they prevent and handle downtime and interruptions.
A large part of availability is resiliency. Resiliency stretches across many areas, from redundant or N+1 data center infrastructure – at least one independent backup component – to offline data backups and replication.
4. Controls – Physical security, logical security, secure software development, incident management, asset management and compliance are key concepts that should be outlined in an information security policy or in their own standalone policy.
Information security is a critical element of an organization’s positive reputation. Be on the lookout for these items in your vendor’s information security policy to verify it’s adequate.
Conduct better and more efficient vendor information security assessments. Download the infographic.