10: 3 Supply Chain Risk Flashcards
Vendor Security Policy Minimum
ensure that vendors policies are at least as stringent as your own
Vendor Management Lifecycle (1)
Vendor Selection - May use Request for Proposals, or an informal process. Assess provider’s risk management program.
Vendor Management Lifecycle (2)
Onboarding - Verify contract details, arrange secure data transfer, establish incident procedures
Vendor Management Lifecycle (3)
Monitoring - Conduct site visits, review independent audits, handle security audits
Vendor Management Lifecycle (4)
Offboarding - Destroy confidential information, unwind a business relationship gracefully
NDAs
Non-disclosure agreement
SLR
Service Level Requirements, document specific requirements customer has about any aspect of the vendor (i.e. system response time)
SLA
Service Level Agreement - describes condition of service and any penalties
MOU
Memorandum of Understanding - letter written to document aspect of relationship (often can be within same organization)
BPA
Business Partnership Agreement (Responsibilties, division of profits
ISA
Interconnection Security Agreement - standards used
MSA
Master Services Agreement - Includes all key terms used to govern relationship
SOW
Statement of Work - for an individual project, governed by MSA
Data Ownership Language
Customer Retains ownership, vendor right to use info is limited, agreements should limit data sharing with third parties
Data protection provisions
important if vendor will be sole custodian of information
Assessment vs Audits origin
Assessments requested by an orgs IT staff, while Audits are performed at request of someone else
Audit
Detailed tests on a specific standard - Follows a formal standard and a review period, should have clearly defined scope
Internal Auditors
Works for the org but reports independently, performing work at request of org leadership
External Auditors
Independent firms that normally perform audits at request of org leadership or regulators
User Access Review
Validate rights and permissions
Gap Analysis
Provides a roadmap for future work
Use of Cloud Service providers on audits
Expands the scope of the audit
SOC Reports
Service Organizational control reports - Audits done by cloud providers themselves
SOC 1
Provides assurance required for customer financial audits
SOC 2
Provides detailed assurance of confidentiality, integrity, and availability controls
SOC 3
Provides high-level public reporting of confidentiality, integrity, and availability controls
Type 1 Report
Describes the controls that the provide has in place and an opinion on the suitability of these controls
Type 2 Report
Includes the Type 1 information, and a test to ensure the controls are working
