NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements

@NTXISSA #NTXISSACSC4
Mitigating Security Risks in
Vendor Agreements
Brian Kirkpatrick, JD, MA (Econ), C|CISO, C|EH
President and Technology Attorney
Kirkpatrick Law PC
October 2016
This presentation is about legal issues, but is not legal advice.
An attorney should be consulted for advice regarding your individual situation.

Answers to Common Questions
We are security professionals, not lawyers.
Why should the contracts be our problem?
NTX ISSA Cyber Security Conference – October 7-8, 2016 2

Security is
everyone’s problem
and responsibility

We are short staffed, budget constrained,
and have too much work already.
Why should I do the
legal department’s job too?

Improve Vendor Agreements
Prevent Big Problems
Security Organization is in the Best Position
to Identify Technical Risks

What’s in it for me?

Build Trust with your Partners
Improve the Legal / Security Relationship

Top Security Issues
Top 5 issues to review:
1. Vendor’s Information Security Program
2. Security Standards
3. Data Breach Insurance
4. Security Audits
5. Information Security Warranty

Vendor’s Information Security Program
We need to understand how the vendor is
currently protecting its customer’s
information.

• The vendor should actually have an
information security program.
• The information security program should
be attached to the agreement.
• The agreement should include a warranty
to comply with the attached program.

Sample basic language:
Vendor warrants that it will at all times
comply with the Information Security
Program attached as Exhibit A.

Security Standards
• The security standards should be identified.
• Who’s standards matter?
• What standards apply?

Security Standards
• Ask the vendor what security standards it
uses to protect its client’s information.
• The “Industry standard” is vague.
• Determine what standards are required by
your industry. PCI-DSS, HIPAA, GLBA, etc.
• Find the standards named in the
agreement.

Security Standards
Vendor will perform in accordance with the
security standards as they apply to the
healthcare industry. Specifically, Vendor will
comply with HIPAA.

Data Breach Insurance
If a Customer’s data is lost, stolen or
misused, how will the Vendor compensate
the Customer?

• Is the vendor insured with the appropriate
coverage types?
• Is the vendor insured at the appropriate
amounts?
• Are the insurance requirements illustrated
in the agreement?
• Is your business named as a beneficiary?

• Sample basic language:
During the term of this agreement and for 3
years thereafter, Vendor shall maintain a
minimum of $500,000 of data breach
insurance, name Customer as the beneficiary,
and provide Customer with a Certificate of
Insurance within 10 days of executing the
agreement.

Security Audits
Customer’s need a mechanism to
verify that the Vendor is providing the
security controls that it promised.

Security Audits
3 ways to audit:
1. Customer enters the physical premises to
audit the controls directly.
2. Vendor obtains a 3rd party audit (SSAE 16)
and provides to Customer.
3. Vendor provides Customer with a signed
self-attestation of compliance.

Security Audits
No less than annually, Vendor will retain a
third-party certified public accounting firm to
perform a SSAE 16 audit of security measures
and provide the report to Customer promptly
after receipt.

Information Security Warranty
Services that include information security
controls and data protection safeguards
should include a warranty to protect the
Customer against a loss.

• Usually, all warranties are disclaimed
unless specifically stated.
• A warranty should be included regarding:
1. Compliance with the security program
2. Performance in accordance with the standards
3. Conducting security audits
4. Maintaining appropriate insurance coverage

Vendor warrants that it will abide by the
security program in Exhibit A, perform the
services in accordance with the [applicable
laws and standards], maintain insurance as
described in this agreement, and conduct an
annual 3rd party audit of the security
controls.

Summary
• Every industry has different risks.
• Vendor contracts are your initial sources for
legal and technical information protection.
• Legal and Security organizations should
form a tight alliance.

@NTXISSA #NTXISSACSC4@NTXISSA #NTXISSACSC4
The Collin College Engineering Department
Collin College Student Chapter of the North Texas ISSA
North Texas ISSA (Information Systems Security Association)
Thank you

NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

En vedette

En vedette (19)

Similaire à NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements

Similaire à NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements (20)

Plus de North Texas Chapter of the ISSA

Plus de North Texas Chapter of the ISSA (15)

Dernier

Dernier (20)

NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements