SpartanTec, Inc. Wilmington: 30 Questions Vendors Should Ask to Reduce Cybersecurity Risk

It is not easy to make a decision about any major organizational change. There are many stakeholders to please, budgets to be met, and risks to manage. There are many issues to consider when you choose and implement a new system. It can also be difficult to ensure that the system meets your cybersecurity expectations and needs. Here are 30 questions to ask when you’re considering a new system.

Questions about data

Where and how is data stored?

You may be able to store your data in-house, or they might store it in the cloud. If your system is cloud-based you should determine the location of the servers. Data is not always stored in the same country as the vendor. This can cause problems if your organization has strict confidentiality policies.

What is the best way to encrypt data?

To reduce the risk of unauthorized access to confidential information in your organization, it is important to ensure that it is properly encrypted.

What is the best way to transmit data?

Data is transferred from one system to another when a new system is implemented. Is there a way to transfer data securely? How will information be transferred to or from the system in the future?

What cybersecurity data protection measures are in place?

What IT security measures has the vendor put in place to protect your data This is a difficult question to answer. Let them talk about their safeguards and strategies.

How can you manage remote access?

Switching to a cloud-based platform is a way for employees to work remotely from anywhere, including home or at a client’s location. It is important that the cloud-based system is secure and allows for complete data access without compromising any data.

How do you manage confidential data and authorized users?

Many companies require different levels of access to their systems. A front-line employee might only have access to information, while an executive may be able modify or delete data. In the same way, confidential data belonging only to one department might be accessible only by those who have logins for that particular department. You should ensure that your system tracks data changes to be able to determine who and when they occurred.

You also need strong password management. This includes regular updates and character requirements.

Who is the owner of the data?

Data ownership refers to the “legal rights and total control over one piece of data or set thereof”. While some vendors might become the owners of your data if you transfer it into their systems, others will allow you to retain ownership. While this may not be a significant issue for some companies, it could have a major impact on others. Make sure the system meets your requirements.

What happens to data when the partnership is ended?

Let’s say your contract expires and you decide to terminate the relationship with the vendor. Is the vendor going to return the data or will it be deleted? This is an important concern and should be addressed in your contract.

Is data permanently deleted after it is deleted?

You must ensure that you can delete a file without any doubt. Some systems allow you to delete an item as an “archive” function. It is hidden from view but still accessible. This could be good or bad depending on the situation. Make sure you fully understand the system’s functions.

What is the best way to recover data in case of loss?

It’s a bad sign if the vendor doesn’t have a data recovery plan. It’s unlikely that they will be able to retrieve your data if they don’t know how to do it.

Do any third parties have access?

Although you are outsourcing data management to a vendor they might have their own outsourcing agreements. You may be able to open your data to multiple entities by entering into an agreement only with one vendor. You must ensure that you have all the relevant information and that any third parties are not a risk to your data. How much access can these organizations have and what management methods do they use to manage them?

Security questions

What are you doing to prevent breaches?

Similar to the previous data protection question, this question confirms that multiple cyber security practices and policies are in place. This question is easy to answer, provided the vendor uses reasonable strategies.

Are you a holder of (x) security certificates?

Vendors may be required to demonstrate a high level of security compliance by your organization. All documentation should be provided by the vendor.

Are you able to provide (x) security measures?

You may need certain methods to protect your data. You should ensure that the vendor can meet all your security requirements and needs.

What are the best cyber security practices?

Formal documentation of internal procedures can help answer this question. This document shows that cyber security is being taken seriously by the company and that employees follow a set of rules.

How often do your scans for vulnerabilities occur?

Vendors who are trusted with sensitive data should regularly scan their systems for vulnerabilities. It is important to know how many issues are typically found and how fast they can be fixed so customers are not adversely affected.

How often does the system get updated?

Technology is constantly changing at a rapid pace. Systems need to be updated regularly to fix vulnerabilities and other issues. While some updates can be released automatically on a regular schedule, others may require system downtime.

Could you please provide the results from your most recent security audit?

It is useful to get a second opinion about the vendor’s security procedures. It will help you clarify any doubts.

Are you using physical data protection?

It’s easy for vendors to overlook physical protection, even though cyber security is so important. For example, there are secured entryways that allow them into data-hosting areas.

Are there any security breaches or issues that you have experienced in the past?

Ask vendors to detail any incidents, including how they were solved, the duration of the exposure, and the impact it had on affected organizations. Most vendors will have experienced some form of security breach, no matter how severe. This should not be taken as a sign that the vendor isn’t trustworthy. It’s more important to look at how the events were managed. The vendor probably has a plan that minimizes losses and recoveries. If they are unable to speak about recovery procedures or if there are frequent incidents, this is a red flag.

Which system monitoring procedures are in use?

It is not unusual to hear of breaches that were not reported until months later, sometimes because vendors didn’t know there was a problem. Vendors should be notified immediately if data is exposed or becomes vulnerable.

What are the reporting requirements?

The vendor should be notified immediately if a potentially dangerous person enters or unauthorized changes are made to the system. Will they get an urgent notification, such as a phone call or alert? Or will it be an email that is not missed? This could make a big difference in a prompt response.

How can you tell customers about security concerns?

Notify you as soon as possible. Determine the typical communication methods and response times of vendors. To properly manage risk, you need to be confident that you are informed about any security issues. So that the vendor can understand your expectations, you should specify your preferred communication method.

Questions for the Security Team

Who is responsible to ensure cyber security?

You can provide information on key contacts or executives responsible for cyber security to show that there are dedicated people working to protect your data. This also helps you to understand who will be responsible in the future for any questions or concerns.

How often do your security personnel receive training?

Cyber risks change constantly and best practices must be updated as well. Regular training should be provided to team members on the policies and procedures that are needed to protect data against the latest hacker attacks and threats.

How can you evaluate the security team’s knowledge?

Information about the selection and monitoring of progress will allow you to understand the depth and knowledge of your employees and will reassure you that all your data will be safe.

How can you get information about cyber security?

Information updates are essential for teams to keep abreast of new threats and risks. Even though a system may be considered the most secure in the market today, tomorrow will bring new vulnerabilities to the surface. To ensure that they are always ready, serious vendors will continue to seek out information on trends.