Knowing Who Has the Keys to Your Data

Giving a vendor or business partner access to your network could mean giving them access to your private files and sensitive information. When not properly secured, they may be able to view your data, or, unintentionally allow a cyber criminal inside. With cyber threats evolving, many organizations may have been breached by a cyber attack and not know it, meaning, that their undetected cyber breach could spread to any of your integrated systems, applications or devices.

Legally, it is the onus of a company to ensure their business partners have healthy cybersecurity practices before granting them access to data. If their client’s sensitive information is leaked due to insufficient due diligence on their part, they can be held legally responsible.

Cyber-screening current and potential business partners

A third-party cybersecurity risk assessment is the most comprehensive way to verify that the entities you partner with have a strong cybersecurity posture before allowing them access to your network. This assessment evaluates the risk of a cyberattack or a breach with a thorough review of the functions, policies, and processes the organization has in place, and the overall potential risk they present to the organization.

The assessment is typically questionnaire-style and can include a technology solution that runs scans and compiles publicly accessible information. While not all reviews look alike, the focus is to figure out how the third-party in question is protecting their data by probing into areas such as:

• Cybersecurity policies and procedures
• Employee awareness and training programs
• Data classification and storage
• Technology protection and configuration
• Penetration testing and other evaluation methods

Data you could unintentionally give business partners access to

Companies collect a lot sensitive data beyond standard demographic information and credit card numbers that they may not be aware of. Here are a handful of sensitive data examples that a small or mid-sized business might store about their larger customers and business partners:

• Lawyer: Confidential legal case documents, and intellectual property (IP)
• Marketing firm: Competitive analysis, marketing strategy, public relations communications
• Accountant: Client financial and banking data, tax documents, and employee/payroll details
• Systems integrator: Security system maps and facility floor plans, security and process documentation, access points, and configuration details
• Manufacturer: Product designs, engineering schematics, input and output data, process data

Wondering if something should be considered sensitive? Here is a quick hack: Ask yourself, “Would it be ok if someone posted this information on a public website?” If the answer is “No,” it is sensitive data.

Taking a third-party cybersecurity risk assessment

Just as you need to vet your third-party vendors, you can expect that a business you partner with will have the same request. For companies with proper security measures, this can reinforce your working relationship or help your organization stand out from a less security-conscious competitor. In contrast, if you do not have a robust cyber framework, a poor assessment can mean losing a contract or losing out on business. Submitting a false report, or failure to submit one at all, is not a good option – therefore, the best strategy is to prepare ahead of time by having a strong cybersecurity posture.

The first step in improving your cybersecurity is merely understanding it. Cyber criminals target businesses of all sizes, not just large enterprises. Protecting your company’s sensitive data, minimizing the risk of phishing, malware, and other cyberattacks, and upholding industry or vendor standards is of critical importance. Publications such as the NIST Cybersecurity Framework can help small businesses navigate the cybersecurity landscape and know what questions to ask. Additionally, using a cybersecurity assessment tool can streamline parts of the process with a series of digestible questions that generate a customized report.

Ensuring that the partners who have keys to your data are cyber-smart is an increasingly important part of doing business in the B2B market. By conducting third-party cybersecurity assessments, you are differentiating your business from the competition, improving your cybersecurity health, and protecting your business from legal ramifications.

Take your free assessment today to find out how your company would perform and how to improve your cybersecurity posture.

More Cybersecurity Assessment Resources:

Get a free Cybersecurity Assessment tool, along with a free automated Network Vulnerability Scanner and Threat Alerts System

Understanding Cybersecurity from a Legal Perspective

Mythbusting: Penetration Testing Requirements for GDPR, HIPAA, and Other Regulations