Cybersecurity In-Depth: Getting answers to questions about IT security threats and best practices from trusted cybersecurity professionals and industry experts.

How Do I Get My Third-Party Suppliers to Meet My Security Standards?

Five security clauses to include in all of your supplier contracts.

2 Min Read

Question: How do I get my third-party suppliers to meet my security standards?

John Pironti, president of IP Architects: Supplier contracts need to include clauses that give suppliers some parameters and incentives to implement appropriate security controls if they want to keep your business. Here are a few types of security clauses you should include in all supplier contracts. 

• Right to audit: To ensure suppliers are not only implementing but sustaining appropriate security measures, include language that lets you audit your suppliers either by yourself or through a mutually agreed upon third party.

• Verification of compliance: If you require your suppliers to be compliant to regulatory requirements (i.e., HIPAA, GLBA) or industry standards (i.e., ISO 27001, PCI), I recommend you contractually require them to demonstrate their compliance at least annually.

• Software maintenance and accountability: If a supplier is developing software for you, you need to know security deficiencies will be remediated at the supplier's cost within a reasonable time frame ("reasonable" based on the severity of the issue). Also, be sure to extend the covered time period to align with the expected useful life of the software being developed.  

• Disclosure of open source software components: Many software and hardware technology solutions are developed using open source components, and as vulnerabilities like Heartbleed and Shellshock first showed us, we cannot assume open source components are secure. If suppliers disclose an inventory of all open source components (including the version number and acquisition source), you'll know to respond when vulnerabilities are discovered.

• Flow down attestation: Vendors must know that you expect them to monitor the security of their vendors as well. Put explicit language in your supplier agreements that requires appropriate security controls be in place for any supplier that can interact with your information infrastructure or data assets.

What do you advise? Let us know in the Comments section, below.

About the Author(s)

John Pironti, President, IP Architects


John P. Pironti is the President of IP Architects LLC. He has designed and implemented enterprise-wide electronic business solutions, information security and risk management strategies and programs, enterprise resilience capabilities, and threat and vulnerability management solutions for key customers in a range of industries, including financial services, insurance, energy, government, hospitality, aerospace, healthcare, pharmaceuticals, media and entertainment, and information technology on a global scale for over 20 years. Mr. Pironti has a number of industry certifications including Certified in the Governance of Enterprise IT (CGEIT), Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP), Certified in Risk and Information System Control (CRISC), Information Systems Security Architecture Professional (ISSAP), and Information Systems Security Management Professional (ISSMP). He frequently provides briefings and acts as a trusted advisor to senior leaders of numerous organizations on information security and risk management and compliance topics and is also a member of a number of technical advisory boards for technology and services firms. He is also a published author and writer, highly quoted and often interviewed by global media, and an award-winning frequent speaker on electronic business and information security and risk management topics at domestic and international industry conferences.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like

More Insights