Your organization may be well defended, but what about the companies you rely on? IT providers, software vendors and service firms often have deep access to your systems or data. When they're breached, you can be too.
Real-world reminders
In the SolarWinds attack, criminals hid malicious code in trusted software updates that reached thousands of organizations. In the Okta incident, attackers got in through a third-party support provider. Neither victim did anything obviously wrong themselves — the risk came through a supplier.
Know who has access
Start with an inventory. For each vendor, record:
- What systems or data they can access.
- How they access them — remote support tools, shared accounts, software updates.
- Who at your organization owns the relationship.
Many organizations are surprised by how many vendors have standing access they no longer need.
Ask the right questions before you sign
- Do they use multi-factor authentication and keep their systems patched?
- Have they been independently assessed — for example, a SOC 2 report or ISO 27001 certification?
- How quickly will they tell you if they're breached?
- Where will your data be stored, and who can see it?
Put it in the contract
- A clear deadline for notifying you of security incidents.
- Minimum security requirements they must maintain.
- Your right to review their security, or receive assessment reports.
- Return or deletion of your data when the contract ends.
Limit and watch vendor access
- Give vendors only the access they need, only when they need it.
- Require multi-factor authentication and individual accounts — no shared logins.
- Log and monitor vendor activity, and review it regularly.
- Remove access as soon as a project or contract ends.
Key takeaways
- Treat vendors with access as part of your own security perimeter.
- Get security commitments in writing before you sign.
- Review vendor access at least once a year.