Scope
Most small businesses focus security efforts on their own systems. They implement firewalls, deploy email filtering, train employees on phishing, and invest in backups. Then a critical vendor gets breached, and the attacker walks through an open door into your network.
Third-party risk is your risk. If a vendor that has access to your systems, your data, or your infrastructure gets compromised, you are compromised. If a vendor you depend on for critical services becomes unavailable, your business becomes unavailable. If a vendor lacks security controls, they become an entry point for attackers. You cannot control whether a vendor gets breached, but you can assess their security posture before you depend on them, and you can prepare your response for when a breach occurs.
This article covers how to assess vendor security, what to include in vendor contracts and SLAs, how to implement vendor access controls, how to prepare for vendor incident response coordination, and the specific actions small businesses should take this month to reduce third-party risk.
Why Third-Party Risk Matters
The data is stark: 64% of businesses have experienced a breach caused by a third-party vendor or supply chain partner. That number is likely higher for small businesseses because are often less sophisticated about vendor assessment and have fewer resources to vet security practices.
There are three ways vendors become risk:
1. Direct Access to Your Systems
Many vendors need access to your networks, databases, or customer data to provide their services: IT managed service providers, cloud providers, payment processors, accounting software, email systems, backup vendors. Each vendor with direct access is a potential entry point for attackers. If a vendor's credentials are compromised, an attacker can reach your systems with those credentials.
2. Dependency and Availability
You depend on vendors for critical services: hosting, email, customer relationship management, payment processing, shipping, supply chain logistics. If a vendor experiences a cyberattack or outage, your business becomes unavailable. The 2024 Atlassian outage, the 2023 MOVEit Transfer attacks, and the CrowdStrike outage in 2024 all caused widespread business disruption because organizations depended on a single vendor without fallback options.
3. Data Access and Privacy
Vendors often hold sensitive data: customer records, financial information, employee personal data, intellectual property. If a vendor experiences a breach, that data is exposed. Your company is responsible for breaches that happened at a vendor.
Vendor Risk Assessment: The Three Tiers
Not all vendors are equal risk. A vendor that only sends you a monthly invoice poses less risk than a vendor with remote access to your production systems. Categorize your vendors by risk:
Tier 1: Critical/High Risk Vendors
These vendors have direct access to your production systems, hold sensitive customer or financial data, or provide services that would disrupt your business if compromised or unavailable. Examples: cloud hosting providers, managed service providers, payment processors, email systems, backup vendors, VPN providers.
For Tier 1 vendors, require comprehensive security assessments. These should include: documented security policies, multi-factor authentication enforcement, encryption of data in transit and at rest, regular security audits or SOC 2 Type II reports, incident response procedures, and notification requirements if they experience a breach.
Tier 2: Medium Risk Vendors
These vendors have limited system access or hold non-sensitive data. Examples: office supply vendors, software that integrates with your systems but doesn't hold production data, contractors who work on-site but have limited access.
For Tier 2 vendors, require basic security documentation: security questionnaire completion, confirmation of multi-factor authentication, basic privacy policy. A SOC 2 Type II report is ideal but not always available for smaller vendors.
Tier 3: Low Risk Vendors
These vendors have no system access and hold no sensitive data. Examples: office utilities, cleaning services, marketing consultants who don't access your systems.
For Tier 3 vendors, standard contracts and liability insurance are sufficient. A security assessment is not necessary.
Vendor Security Assessment: What to Ask
Comprehensive security assessment starts with a questionnaire. Many vendors will have completed standard questionnaires like the CAIQ (Consensus Assessments Initiative Questionnaire) or VSAQ (Vendor Security Assessment Questionnaire). If they have, request it. If they don't, provide your own questionnaire or use a pre-built template.
Key questions for Tier 1 vendors:
Access Control
- Does your organization enforce multi-factor authentication for all user accounts? If not, which accounts are exempt and why?
- Do you use role-based access control? Can you provide documentation of the roles and access levels?
- How do you manage privileged accounts (admin access)? Is there separation of duties?
- How often do you audit access controls? Can you provide audit logs?
Encryption and Data Protection
- Do you encrypt customer data in transit and at rest? What encryption standards do you use?
- How are encryption keys managed? Are they stored separately from encrypted data?
- Do you have data retention and deletion policies? How long is data retained?
- Can you delete customer data on request? How long does deletion take?
Vulnerability Management and Patching
- How frequently do you patch systems and applications? What is your maximum patch deployment time?
- Do you conduct regular vulnerability assessments or penetration testing? How often?
- Do you have a vulnerability disclosure program?
Incident Response and Notification
- Do you have a documented incident response plan? Can you share it?
- How quickly will you notify customers if your systems are compromised? What is your notification timeline?
- What information will you provide in a breach notification?
- Will you provide forensic reports if you experience a breach?
Compliance and Audits
- Are you compliant with relevant regulations (GDPR, HIPAA, PCI DSS, SOC 2)? Can you provide documentation?
- When was your most recent third-party security audit or SOC 2 report?
- Do you allow customer audits or penetration testing?
Subcontractors and Supply Chain
- Do you use subcontractors to provide services? How do you assess their security?
- Are customers notified if subcontractors have access to their data?
Vendor Contracts: Critical Clauses
A vendor questionnaire tells you what a vendor claims about their security. A contract tells you what they're legally obligated to do. Make sure these clauses are in your vendor contracts:
Security Requirements Clause
Specify the minimum security standards the vendor must maintain: MFA, encryption, data classification, access controls, audit procedures. Make this a binding obligation, not just a best practice.
Breach Notification Clause
Require the vendor to notify you immediately (within 24-72 hours, depending on severity) if they discover or suspect a breach affecting your data. Include what information they must provide: nature of breach, data affected, when it was discovered, remediation steps, and contact information for incident response.
Data Protection and Privacy Clause
Specify that the vendor must comply with applicable privacy laws (GDPR, CCPA, local laws). Include requirements for data encryption, secure deletion, and data portability. Specify that they cannot use your data for their own purposes.
Right to Audit Clause
Reserve the right to audit the vendor's security practices, request SOC 2 reports, or conduct security assessments. Specify how often audits can occur (annually is standard) and under what conditions.
Subcontractor Clause
Require the vendor to notify you of any subcontractors who will have access to your data. Reserve the right to object to specific subcontractors. Require the vendor to ensure subcontractors comply with the same security standards.
Incident Response and Cooperation Clause
Require the vendor to cooperate fully with your incident response efforts if they experience a breach. This includes preserving evidence, providing forensic reports, and assisting with customer notification.
Liability and Insurance Clause
Specify liability limits for security failures. Require the vendor to maintain cyber liability insurance and errors and omissions insurance. Confirm the minimum coverage amounts.
Service Level Agreement (SLA) Clause
Define performance standards: uptime percentage, maximum downtime for maintenance, maximum incident response time, maximum data retrieval time. Tie financial penalties (credits or refunds) to SLA violations.
Vendor Access Control: Limiting the Blast Radius
Even if a vendor's security is strong, follow the principle of least privilege: vendors should have only the access they need to provide their service, nothing more.
Principle of Least Privilege
- Segmented access: Vendor access should be limited to specific systems or data they need. If a vendor needs access to your email system, they should not have access to your database. Use network segmentation (see Network Segmentation article) to isolate vendor access.
- Time-limited access: For temporary vendors or contract work, grant access for a specific duration. Revoke access when the contract ends, not months later.
- Separate credentials: Vendors should have dedicated accounts, not shared accounts. Track which vendor has which access. When a vendor ends, revoke only their access.
- Multi-factor authentication: Require MFA on all vendor accounts, especially those with production access.
- Audit logging: Enable comprehensive logging of vendor actions. Monitor for suspicious activity.
Vendor Off-boarding
When a vendor relationship ends, immediately revoke all access. Audit logs should show no activity from that vendor account. Change passwords or API keys that the vendor had. If the vendor had access to sensitive systems, conduct a security assessment to verify no backdoors or unauthorized changes were made.
Preparing for Vendor Incident Response
When a vendor experiences a breach, you need to coordinate your response immediately. A prepared incident response plan for vendor breaches will save critical time.
Vendor Incident Response Plan
- Notification trigger: Define what counts as a breach that requires immediate notification (any unauthorized access, not just data exfiltration).
- Escalation path: Define who gets notified and in what order (CISO, CEO, legal, insurance carrier).
- Response coordinator: Assign one person as the primary contact for vendor incident response. Have a backup.
- Investigation support: Define what information you need from the vendor (forensic report, timeline, affected systems, remediation steps).
- Customer notification: Define your timeline for notifying customers if their data was affected. Legal requirements vary by jurisdiction (typically 30-60 days), but consider notifying faster.
- Evidence preservation: Require the vendor to preserve all evidence and logs related to the incident for forensic analysis.
Vendor Breach Scenario
Walk through a realistic scenario: a vendor that has access to your customer database experiences a ransomware attack. Their systems are encrypted. Attackers claim to have exfiltrated customer data and are demanding ransom. What do you do?
Step 1: Verify the claim. Contact the vendor immediately and confirm the scope of the breach. Did your data actually get exfiltrated? How much? What type of data?
Step 2: Assess impact. Determine which customers were affected and what data was exposed. Assess regulatory requirements (if HIPAA, GDPR, or other compliance frameworks apply, notification is mandatory).
Step 3: Notify your insurance carrier. Most cyber policies require notification within 24-72 hours. Don't wait for investigation to complete.
Step 4: Prepare customer notification. Draft the notification message, determine the timeline (notification within 30-60 days is typical for most regulations), and prepare for customer support volume.
Step 5: Document everything. Preserve all communications with the vendor, timeline of events, decisions made, and remediation steps taken. This becomes evidence if customers sue or regulators investigate.
Vendor Risk Monitoring: Ongoing Assessment
Vendor security assessment is not a one-time event. Vendors change. Their security posture degrades. New vulnerabilities emerge. Monitor vendor security continuously:
Annual Re-assessment
Request updated security questionnaires annually from Tier 1 vendors. Ask specifically what has changed since the last assessment: new vulnerabilities, security incidents, changes to incident response procedures.
Breach Monitoring
Subscribe to breach notification services or monitoring that alerts you if vendors you depend on experience public breaches. Tools like Have I Been Pwned, Security Headers, or commercial OSINT tools can help.
Industry Alerts
Follow security news and alerts related to vendors you use. When a new vulnerability is discovered in software or platforms you depend on, understand if you're affected and what the vendor's response is.
Supplier Concentration Risk
Assess concentration risk: how many critical business functions depend on a single vendor? If that vendor fails, how much of your business stops? Consider alternative vendors or fallback procedures for vendors you cannot replace.
Vendor Risk for Small Businesses: Practical Approach
Comprehensive vendor risk management sounds like a lot of work. For small businesses with limited resources, focus on what matters most:
Week 1: Vendor Inventory
List all vendors that have access to your systems or data, or that provide critical services. For each, note: what access do they have, what data do they hold, how critical are they to your business.
Week 2: Categorization
Categorize vendors into Tiers 1, 2, and 3. Focus assessment effort on Tier 1 vendors (critical vendors with system access or sensitive data).
Week 3: Tier 1 Assessment
For each Tier 1 vendor, complete a security questionnaire. Use a standard template (CAIQ, VSAQ, or your own). Request SOC 2 reports if available. For vendors that won't provide documentation, schedule a call and discuss their security practices.
Week 4: Contract Review
Review vendor contracts for critical clauses: breach notification, data protection, right to audit, SLA. If critical clauses are missing, request amendments.
Ongoing: Access Control
Implement access controls for Tier 1 vendors: separate accounts, MFA, limited access to required systems only. Audit vendor access quarterly.
Third-Party Risk and Cyber Insurance
Many cyber insurance policies include third-party liability coverage, which pays for notification costs and credit monitoring if customer data is exposed via a vendor breach. However, some policies exclude breaches that result from vendor negligence or require you to have performed due diligence on vendors before the breach.
Maintain documentation of your vendor assessment process: completed questionnaires, SOC 2 reports, audit results, contract amendments requesting security improvements. This documentation demonstrates reasonable care if a vendor breach occurs and a claim is disputed.
What to Do Now
- This week: Create an inventory of all vendors with system access or sensitive data. For each, document what access they have and how critical they are to your business.
- This week: Categorize vendors into Tiers 1, 2, and 3 based on risk. Tier 1 = critical access or sensitive data. Tier 2 = limited access. Tier 3 = no access.
- Next week: For your top 3 Tier 1 vendors, request SOC 2 Type II reports or complete a security questionnaire. Document their responses.
- Next week: Review your vendor contracts for critical security clauses: breach notification timeline, data protection requirements, right to audit, incident response cooperation.
- Next 30 days: For each Tier 1 vendor, implement access controls: separate accounts, MFA, network segmentation. Audit vendor access and monitor for suspicious activity.
- Next 30 days: Document your vendor incident response plan: who gets notified if a vendor is breached, escalation procedures, customer notification timeline.