Vendor Information Security Policy: What Should Be Included

Top Requirements of Your Vendor’s Information Security Policy

Let’s delve further into the integral components of a vendor information security policy. A comprehensive information security policy should include the following:

1. Confidentiality –To guarantee confidentiality, vendor communications channels and media must be properly monitored and controlled to prevent unauthorized access. Your vendor’s information security policy should include steps for ensuring appropriate user logical access. These logical access controls should include key concepts such as password requirements, the principle of least privilege and separation of duties.
   
   Here is some helpful guidance to obtain this:
    
   • The principle of least privilege means that a user should only have access to the resources needed to perform their defined role. For example, employee personal identifiable information (PII) should only be accessed by an appropriate individual in human resources.
   • Separation of duties prevents a single user from taking both actions of performing a task and approving that it was properly done. A common implementation of this rule is within a software change management program. Developers should not be able to promote their code from a test environment to a production environment on their own.
   • Password requirements should include configuration minimums such as length, character parameters, complexity requirements, etc.
2. Integrity –This ensures that data isn't modified in  unauthorized ways. To guarantee integrity, vendors should be able to demonstrate that they have controls in place to protect information from unauthorized modification. One way to do this is by ensuring proper input, processing and output controls are in place and documented within the vendor information security policy.
3. Availability –Information should only be available when needed and only to those who are authorized to access it. Vendors should be able to validate how they prevent and handle downtime and interruptions.
   
   Resiliency is also a large component of availability and stretches across many areas. This can include redundant or N+1 data center infrastructure with at least one independent backup component, or offline data backups and replication.
4. Controls – Physical security, logical security, secure software development, incident management, asset management and compliance are key concepts that should be outlined in a vendor information security policy or in a standalone policy.