Your Security Is Only as Strong as Your Vendors' Security

Every supplier with access to your systems or data is a door into your company. Attackers know that the side door is often easier than the front.

Ask before you sign, and again every year

• What data or systems will they touch?

• Do they use multi-factor authentication and encrypt your data?

• How quickly will they tell you if they have an incident?

• What happens to your data if the contract ends?

Keep it practical

You don't need a 300-question survey for every vendor. Tier them by what they can reach. A one-page questionnaire for most, a deeper review for the few with real access, and contract language that requires prompt breach notification.

A one-page questionnaire beats finding out after a breach. Who holds the keys to your house?

Views are my own. Dave Trader is a CISO, U.S. Marine Corps veteran, and author of The Cybersecurity Endgame.