Cybersecurity for small business: Vendor security

Not many small businesses do business these days without the services of third-party vendors, some of whom have access to your company’s sensitive information. Even if you run a tight cybersecurity ship, what happens if your accountant loses a laptop or the payroll company that connects to your network experiences a security breach? Your business could be in jeopardy, of course, but that’s not all. Regardless of the circumstances surrounding the vendor’s breach, customers may focus on the fact that they trusted you with the data and now they’re at risk for identity theft.

So it’s in your interest to be very interested in how the companies you work with protect personal information. The FTC has new cybersecurity resources for small businesses with tips on keeping tabs on your vendors’ security practices.

How to monitor your vendors

When you transfer sensitive information to a vendor – whether it’s confidential paperwork or digital data – what steps can you take to help secure it?

• Put it in writing. Spell out your security expectations up front and include specific provisions in your contracts about protecting data. If a vendor vacillates, maybe they’re not the right partner for you.
• Verify compliance. “Trust, but verify,” as the adage goes. Don’t just take vendors at their word. Establish a process so you can confirm they’re following your rules.
• Make changes as needed. Cyber threats are constantly morphing. Make sure the security methods your vendors use are up to date – and up to your data.

How to protect your business

If vendors have access to your network, what can you do to reduce the risk of a mishap?

• Control access. Not everybody needs a backstage pass to your company’s sensitive information. When there is a legitimate business need for a certain vendor to have access, grant it on a need-to-know basis and only for the time it takes the vendor to complete the task.
• Safeguard your data. Use strong encryption and configure it properly. That helps protects sensitive information as it’s transferred and stored.
• Secure your network. Require strong passwords: at least 12 characters, both capital letters and lower-case, and a mix of numbers and symbols. Don’t reuse passwords and don’t share them. To stymie password-guessing software, use tools to limit the number of unsuccessful log-in attempts.
• Use multi-factor authentication. Rather than relying just on a password, insist that vendors take an additional step – maybe a temporary code on smartphone or a key inserted into a computer – before accessing your network.

What to do if a vendor has a security breach

• Contact the authorities. Report the attack right away to your local police. Some departments have special cybercrime units. But if they’re not familiar with investigating data incidents, contact your local FBI.
• Confirm the vendor has a fix and follows through with it. Insist on straight answers from your vendor and an effective plan of action to correct vulnerabilities. If you choose to continue as a customer, ask for specifics on what they’re doing to keep your data safe going forward.
• Notify customers. If customer or employee information was compromised, notify the affected parties, who may be at risk for identity theft. Read Data Breach Response: A Guide for Business for more advice and refer concerned people to www.identitytheft.gov.

The FTC has a factsheet about vendor security. Make it required reading for any employee who interacts with vendors. There is a short quiz to evaluate if they’ve mastered the basic principles.

If cybersecurity issues are on your mind, you may be thinking about the related issue of cyberinsurance. When we met with small business owners to hear about their cyber concerns, they had questions about that topic. We’re happy to pass along this information with thanks to the National Association of Insurance Commissioners (NAIC) for their role in developing it.