Let’s call the company HSH Limited. The company uses a lot of third-party companies to serve their customers, to fulfil deliveries and to keep their physical environment clean and secure. They use other third-party companies for the storage, deletion and archiving of sensitive and non-sensitive data.
In one of their third-party supplier audits, they found out that one of their suppliers’ sub-contracts their services to another company. This raises a red flag. However, because they have been with the business for a long time, the InfoSec manager overlooks their processes and continues HSH Limited’s processes as normal. The InfoSec Manager only warns the third-party supplier to ensure they stopped using those subcontractors without any sort of verification.
Some months later, there was a massive leak of HSH Limited’s data. After a thorough investigation, it was discovered that the overlooked supplier caused the leak.
Third party companies usually play a very vital role in the processing of Data Controllers’ data. Data controllers rely heavily on these suppliers to make their businesses function daily. Yet, most data controllers fail to follow due process when selecting these third-party suppliers. In this week’s piece, I enumerate steps that companies relying on third party suppliers must do.
The first step is the initial assessment. Before any company takes on the services of a third-party company, there is a Request for Proposal (RFP) and Request for Information (RFI). In this document the supplier explains their services, their time deliverables, and, most importantly, they must include their data privacy schemes. Before privacy regulations started gaining ground, RFPs and RFIs didn’t carry privacy terms. Now, it’s good practise or expected that third party companies include these terms.
Companies must come into legal agreement with these third-party suppliers. There are certain clauses that can’t be missed. There is the need to verify the kind of insurance the supplier possesses and how they manage their risks. The legal agreement must contain the following: privacy controls including the kind of training that has been done for staff, vulnerability and threat assessments, the kind of security certifications they have, incident notification systems, the right to audit the third-party company, a periodic review of their business processes. These things must be properly teased out in the legal agreement. These things bring things into perspective. The controller should not be in a hurry to sign an agreement if these boxes have not been ticked.
In practise, most companies send out questionnaires to third parties for filling. This is usually the standard. Most companies won’t go a step further to verify and seek evidence of everything answered in the questionnaires. Because a supplier ticks positively doesn’t mean they have the controls in place. If a company, for example, says they have certain encryptions, then they should be able to provide evidence.
Then the third-party company should ensure that the third-party supplier has Risk mitigation strategies in place. Usually this will entail finding out if they’ve identified all the risks within their business and if they have mitigated or treated these risks accordingly. The data controller must also ensure that the third-party supplier must have the evidence to support what they claim.
It’s good to have metrics and reporting. This way the data controller can measure breaches, risks, threats, vulnerabilities, and other factors that might lead to a breach. Through these metrics, the management, from the data controller perspective, can deduce the next steps to take and the metrics can inform them on the next strategic business moves.
Data controllers must have a catalogue of all third-party companies they use, carry out periodic reviews and ensure that these suppliers are meeting their contractual obligations.
For more information on how to engage third party suppliers in information governance, send us a message.