(270) 506-5140 CONTACT US

Vendor Information Security Policy: What Should Be Included

Oct 22, 2019 by Lisa-Mae Hill, CTPRP

Strong information security is crucial to safeguarding your organization and customer data. Information security always keeps confidentiality, integrity and availability at the core. This means the following:

  • Confidentiality: Preventing unauthorized disclosure of information
  • Integrity: Ensuring that data isn’t modified in unauthorized means
  • Availability: Ensuring that information is available when needed and only to authorized personnel
  • Your third party vendor should have a well-developed information security policy that includes controls that address these key concepts. Equally as important as having a policy is validating that it has been implemented and is reviewed annually.

Top Requirements of Your Vendor’s Information Security Policy

Let’s delve further into the integral components of a vendor information security policy. A comprehensive information security policy should include the following:

1. Confidentiality – To guarantee confidentiality, vendor communications channels and media must be properly monitored and controlled to prevent unauthorized access. Your vendor’s Information security policy should include steps for ensuring appropriate user logical access.

Logical access controls should include key concepts such as password requirements, the principle of least privilege and separation of duties. Here is some helpful guidance to obtain this:

  • The principle of least privilege says that a user should only be able to access the resources needed to perform their defined role, such as only HR being able to access employee personal identifiable information (PII).
  • Separation of duties says that a user should not be able to perform a task and also approve that the task was done properly. A common implementation of this is within a software change management program where developers should not be able to promote their code from a test environment to a production environment on their own.
  • Password requirements should include configuration minimums such as length, character parameters, complexity requirements, etc.

2. Integrity –This means to ensure that data isn’t modified by unauthorized ways. To guarantee integrity, vendors should be able to demonstrate that they have controls in place to protect information from unauthorized modification. One way to do this is by ensuring proper input, processing and output controls are in place and documented within the vendor information security policy.

3. Availability – This is ensuring that information is available when needed and only to those authorized to have it. Vendors should be able to validate how they prevent and handle downtime and interruptions.

A large part of availability is resiliency. Resiliency stretches across many areas, from redundant or N+1 data center infrastructure – at least one independent backup component – to offline data backups and replication.

4. Controls – Physical security, logical security, secure software development, incident management, asset management and compliance are key concepts that should be outlined in an information security policy or in their own standalone policy.

Information security is a critical element of an organization’s positive reputation. Be on the lookout for these items in your vendor’s information security policy to verify it’s adequate.

Conduct better and more efficient vendor information security assessments. Download the infographic.

information security assessments

Lisa-Mae Hill, CTPRP

Written by Lisa-Mae Hill, CTPRP

Lisa-Mae is an experienced cybersecurity analyst with experience in both the private and public sectors. She has held the role of Subject Matter Expert and Information System Security Officer for a government based contractor and has extensive experience in Certification & Accreditation, CIS Critical Control Implementation and Auditing, Security Assessments and cybersecurity Policy. She has a Bachelor’s degree in Information Technology Management from State University of New York Delhi paired with many hours of additional cybersecurity and industry related training. She is also a Certified Third Party Risk Professional (CTPRP).

Follow Lisa-Mae Hill, CTPRP

Subscribe to the Venminder Blog