Download - NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements

@NTXISSA#NTXISSACSC4

MitigatingSecurityRisksinVendorAgreements

BrianKirkpatrick,JD,MA(Econ),C|CISO,C|EHPresidentandTechnologyAttorney

KirkpatrickLawPCOctober2016

Thispresentationisaboutlegalissues,butisnotlegaladvice.Anattorneyshouldbeconsultedforadviceregardingyourindividualsituation.


AnswerstoCommonQuestions

Wearesecurityprofessionals,notlawyers.

Whyshouldthecontractsbeourproblem?

NTXISSACyberSecurityConference– October7-8,2016 2



Securityiseveryone’sproblemandresponsibility




Weareshortstaffed,budgetconstrained,andhavetoomuchworkalready.

WhyshouldIdothelegaldepartment’sjobtoo?




ImproveVendorAgreements

PreventBigProblems

SecurityOrganizationisintheBestPositiontoIdentifyTechnicalRisks




What’sinitforme?



BuildTrustwithyourPartners

ImprovetheLegal/SecurityRelationship



TopSecurityIssues

Top5issuestoreview:

1. Vendor’sInformationSecurityProgram2. SecurityStandards3. DataBreachInsurance4. SecurityAudits5. InformationSecurityWarranty



Vendor’sInformationSecurityProgram

Weneedtounderstandhowthevendoriscurrentlyprotectingitscustomer’s

information.




• Thevendorshouldactuallyhaveaninformationsecurityprogram.

• Theinformationsecurityprogramshouldbeattachedtotheagreement.

• Theagreementshouldincludeawarrantytocomplywiththeattachedprogram.




Samplebasiclanguage:

VendorwarrantsthatitwillatalltimescomplywiththeInformationSecurityProgramattachedasExhibitA.



SecurityStandards

• Thesecuritystandardsshouldbeidentified.

• Who’sstandardsmatter?

• Whatstandardsapply?



SecurityStandards

• Askthevendorwhatsecuritystandardsitusestoprotectitsclient’sinformation.

• The“Industrystandard”isvague.

• Determinewhatstandardsarerequiredbyyourindustry.PCI-DSS,HIPAA,GLBA,etc.

• Findthestandardsnamedintheagreement.



SecurityStandards


Vendorwillperforminaccordancewiththesecuritystandardsastheyapplytothehealthcareindustry.Specifically,VendorwillcomplywithHIPAA.



DataBreachInsurance

IfaCustomer’sdataislost,stolenormisused,howwilltheVendorcompensate

theCustomer?



DataBreachInsurance

• Isthevendorinsuredwiththeappropriatecoveragetypes?• Isthevendorinsuredattheappropriateamounts?• Aretheinsurancerequirementsillustratedintheagreement?• Isyourbusinessnamedasabeneficiary?



DataBreachInsurance

• Samplebasiclanguage:

Duringthetermofthisagreementandfor3yearsthereafter,Vendorshallmaintainaminimumof$500,000ofdatabreachinsurance,nameCustomerasthebeneficiary,andprovideCustomerwithaCertificateofInsurancewithin10daysofexecutingtheagreement.



SecurityAudits

Customer’sneedamechanismtoverifythattheVendorisprovidingthesecuritycontrolsthatitpromised.



SecurityAudits

3waystoaudit:

1. Customerentersthephysicalpremisestoauditthecontrolsdirectly.

2. Vendorobtainsa3rd partyaudit(SSAE16)andprovidestoCustomer.

3. VendorprovidesCustomerwithasignedself-attestationofcompliance.



SecurityAudits


Nolessthanannually,Vendorwillretainathird-partycertifiedpublicaccountingfirmtoperformaSSAE16auditofsecuritymeasuresandprovidethereporttoCustomerpromptlyafterreceipt.



InformationSecurityWarranty

Servicesthatincludeinformationsecuritycontrolsanddataprotectionsafeguardsshouldincludeawarrantytoprotectthe

Customeragainstaloss.




• Usually,allwarrantiesaredisclaimedunlessspecificallystated.

• Awarrantyshouldbeincludedregarding:1. Compliancewiththesecurityprogram2. Performanceinaccordancewiththestandards3. Conductingsecurityaudits4. Maintainingappropriateinsurancecoverage





VendorwarrantsthatitwillabidebythesecurityprograminExhibitA,performtheservicesinaccordancewiththe[applicablelawsandstandards],maintaininsuranceasdescribedinthisagreement,andconductanannual3rd partyauditofthesecuritycontrols.



Summary

• Everyindustryhasdifferentrisks.

• Vendorcontractsareyourinitialsourcesforlegalandtechnicalinformationprotection.

• LegalandSecurityorganizationsshouldformatightalliance.


@NTXISSA#NTXISSACSC4@NTXISSA#NTXISSACSC4

The Collin College Engineering DepartmentCollin College StudentChapteroftheNorthTexasISSA

NorthTexasISSA(InformationSystemsSecurityAssociation)


Thankyou

Download - NTXISSACSC4 - Mitigating Security Risks in Vendor Agreements

Top Related