Search

Finding the Right Legal Representation for Your Company

Cyber Security And Suppliers: What Businesses Must Know

23 January 2016

Tracy Roberts

Over the years, Home Depot, CVS, Experian, and various other companies have suffered massive cyber-attacks that have left their customers' and their own sensitive data exposed. Because of the increase in security breaches, it is more important than ever for businesses to consider their own cyber security system and whether or not it adequately extends to all of their merchants and other business relations. In order to keep your business safe and secure, here are a few things you need to know when it comes to cyber risk management and your company vendors:

Don't Overlook the True Importance of Vendor Security.

Depending on the type of business that you run, you probably rely heavily on various suppliers. It's virtually impossible to be able to keep your business up and going without sharing some of your company's sensitive data with these vendors. Unfortunately, if a cyber-attack were to occur on one of your suppliers, this would not only compromise their information, but it would potentially put your company at risk of being exposed and liable for any damage that occurs with the sensitive company information that is retrieved from the vendor's database. In other words, just because it was the merchant that got hacked, it doesn't mean that you may not be held liable.

Take the Necessary First Steps to Minimize Your Overall Liability.

To help reduce your liability, do your homework on the supplier. Check references, interview them carefully and get to know them. Find out if they subcontract any of their work that they get from you. Another important steps is to request the vendor's security and IT policies so that you can review them and ensure that they meet your personal standards. You may also want to see if their business has undergone an assessment of their security vulnerability, as this report the vendor's risk as well as how effective their security controls are.

Invest in Hands-On Cyber Security Training.

Even after you have done your due diligence on researching a supplier before doing business with them, this doesn't mean that their practices may not change over time or that their database will not become more vulnerable. Therefore, in order to stay on top of things, consider investing in hands-on cyber security training, particularly drills and simulated tests. This will help you see just how effective the system is that your merchant has in place. If they fail the test, you can offer some solutions and improvements from your in-house IT professionals or you can let them go.

Be Firm with Vendor Contracts in Terms of Cyber Security.

As a business, you need to protect your own assets as much as possible. Therefore, when you enter into a contractual agreement with a supplier, you want to make sure that the agreement contains a few stipulations that they must follow in order to avoid breach of contract. For example, you could require that they always have a two-step authentication when logging into accounts and that passwords must be changed every 90 days, while also including uppercase, lowercase, special characters and numbers. If they aren't willing, then your business is likely better off locating a different merchant.

If you would like more advice on how to handle security issues with suppliers, especially tips targeted to your specific industry and business, consult with a professional attorney that specializes in corporate law, like George M Cappello, Lawyer. 

Share