Welcome Guest. | Log In | Register | Membership Benefits


Topics:   Security Views : Compliance Tech Center

Partner Management: Compliance Program Is Essential

Understanding the risk associated with a partner relationship and managing it accordingly is key

Nov 26, 2011 | 12:02 PM | 

By Richard E. Mackey, Jr.
Dark Reading

If you look at almost every regulation or contract, from HIPAA to state privacy laws to PCI DSS, every one has provisions for managing partners that have access to protected data. However, many organizations new to compliance (or with immature compliance programs) have a difficult time determining how to “manage” their vendors.

The key to effective management of vendors is to understand the risk that each vendor poses, and to manage that risk over the long term. This means assessing risk, establishing controls, and monitoring the effectiveness of the controls periodically for the life of the relationship.

Regulations require organizations to monitor the state of the relationship and take responsibility for the practices of the partner. These relationships require assessment, legal agreements, and regular communication. At the heart of this practice is the idea that organizations need to view a breach at a partner as just as dangerous as a compromise in their own enterprises.

The first step in effectively managing partners is to understand what data is shared with a partner and to determine the inherent risk. The inherent risk is the worst-case scenario in which the data is compromised. This means imagining the compromise without factoring in the likelihood of it occurring. Understanding inherent risk allows an organization to understand the criticality of the vendor and determine to what degree it should invest in analyzing its security practices and protecting the data.

Once you understand the data shared, you should ask yourself whether all the data needs to be shared. Sometimes this analysis and some creative thinking can eliminate sensitive data fields and substantially reduce the risk of compromise. However, it could be that critical information needs to be shared. If so, you’ll need to ensure that the organization is going to protect the data in a compliant manner.

If the data is extremely sensitive (e.g., includes Social Security numbers, protected health information, or payment card data), you will need to find a cost-effective method for analyzing the vendor’s security and compliance controls. The options are to conduct your own assessment, contract someone to conduct an assessment, or trust someone else’s assessment.

In a future post, I’ll describe ways to assess whether the vendor is capable of meeting your requirements and the pros and cons of various assessment methods. The important point to remember is that you need to be confident that the vendor’s business model, technical controls, and legal commitments will allow you to comply the particular regulation or regulations that require you to protect the data.

Richard Mackey is vice president of consulting at SystemExperts Corp.



Currently we allow the following HTML tags in comments:

Single tags

These tags can be used alone and don't need an ending tag.

<br> Defines a single line break

<hr> Defines a horizontal line

Matching tags

These require an ending tag - e.g. <i>italic text</i>

<a> Defines an anchor

<b> Defines bold text

<big> Defines big text

<blockquote> Defines a long quotation

<caption> Defines a table caption

<cite> Defines a citation

<code> Defines computer code text

<em> Defines emphasized text

<fieldset> Defines a border around elements in a form

<h1> This is heading 1

<h2> This is heading 2

<h3> This is heading 3

<h4> This is heading 4

<h5> This is heading 5

<h6> This is heading 6

<i> Defines italic text

<p> Defines a paragraph

<pre> Defines preformatted text

<q> Defines a short quotation

<samp> Defines sample computer code text

<small> Defines small text

<span> Defines a section in a document

<s> Defines strikethrough text

<strike> Defines strikethrough text

<strong> Defines strong text

<sub> Defines subscripted text

<sup> Defines superscripted text

<u> Defines underlined text

Dark Reading encourages readers to engage in spirited, healthy debate, including taking us to task. However, Dark Reading moderates all comments posted to our site, and reserves the right to modify or remove any content that it determines to be derogatory, offensive, inflammatory, vulgar, irrelevant/off-topic, racist or obvious marketing/SPAM. Dark Reading further reserves the right to disable the profile of any commenter participating in said activities.

Disqus Tips To upload an avatar photo, first complete your Disqus profile. | View the list of supported HTML tags you can use to style comments. | Please read our commenting policy.
Subscribe to RSS



Compliance Reports

report How To Boost Security Via FFIEC Compliance
With just a smartphone, users can conduct nearly all their banking business at any time of the day or night. However, all this flexibility and convenience opens up new avenues for fraud and cybercrime. Guidelines laid out by the FFIEC several years ago predate many of the capabilities-and vulnerabilities-that are in place today. In this report, we examine the latest guidelines and provide advice on how you can extend the work done to comply with FFIEC guidelines to strengthen your organization's overall security posture and keep customers and their data safe.

report Keeping Compliance In Check
Configuration mistakes, access control gaffes, poor documentation--it doesn?t take much for a compliance audit to go all wrong. In this special retrospective of recent news coverage, Dark Reading takes a look at the costs, common missteps and best practices for compliance, as well as the day the Internet nearly went dark due to the threat of new regulations.

report FISMA Lifts All Compliance Boats
FISMA may not be on your radar now, but it likely will be at some point. Geared specifically toward the federal government and its affiliate agencies and third parties, FISMA is a very specific set of requirements aimed at establishing and maintaining at least a baseline level of computer and network security. FISMA requires unique categorization and classification of information assets, not to mention a boatload of documentation to prove compliance. But once your organization achieves FISMA compliance, it will likely be compliant with just about every security mandate out there.

Other reports from the Compliance Tech Center:

Related Content

Log Management in 2012 and Beyond
2012 brings interesting changes to the log management world. Now, more than ever, it is critical to understand the impact to your log infrastructure and the solutions that will better prepare you to manage your security posture.

SANS Log Management Survey Report
Organizations are increasingly dependent on log management to support core business functions, including cost management, service level and line-of-business application monitoring, as well as traditional IT- and security-focused activities.

Cut the Time and Effort of Troubleshooting and Reporting
Organizations generate millions of logs a day and struggle with centralized collection, storage and analysis of those logs. ArcSight Logger is a universal log management solution that unifies searching, reporting, alerting and analysis across any type of IT data. It consolidates silos of logs into a single indexed repository for fast detection and mitigation of operational issues.

Get Turnkey and Automated PCI Compliance
PCI compliance monitoring is seamless with the self-contained ArcSight PCI Logger solution for log collection, storage and analysis. No database administration expertise is required and a web-based interface simplifies deployment and ongoing management.

Swiss Bank Meets Compliance Requirements and Protects Customer Data
Due to long-term data retention requirements, Swiss bank EFG needed a cost-effective way to collect, secure and store audit-quality log data in an easily accessible log repository. ArcSight Logger helps EFG meet key requirements of Switzerland?s banking laws fast and cost-effectively.




Featured Webcasts
Featured Whitepapers
Featured Reports