Cyber Incidents - Not if, but When (And When Just Happened)

For those of us in information security or cybersecurity, we have long said that it is not a matter of if but a matter of when you will be impacted by a breach or an incident. Over the last several weeks, we have seen when happening more frequently.

In most of these cases, the when was caused by a third-party and not necessarily the affected organization. From a Virtual Chief Information Security Officer’s (vCISO) perspective, we evaluate the risk from third parties (vendors) as part of a contractual onboarding or due diligence process for our clients. Typically, this comes in the form of a vendor management risk assessment. Assessing vendors is an essential component of an overall information security program. Assessing the risk vendors pose to an organization helps us establish and implement controls to understand what risks are present as well as a detailed remediation strategy to mitigate that risk.

During these assessments, I feel that many have become hyper focused of the protection of “sensitive data” – how will the vendor protect personally identifiable information (PII), protected health information (PHI), etc. What is often overlooked is how third-party incidents will impact the business operations. I see this as the intersection of vendor risk management and business continuity. A holistic vendor management program can assist in developing and implementing a comprehensive strategy that will provide a framework that can be used to effectively risk assess/rank your vendors as well as their criticality and impact to your business. An important first step is to establish timeframes for reviewing vendor contracts (both prospective vendors and renewals), along with defined steps for due diligence with new vendors in collaboration with business stakeholders. This approach allows the program to address both initial risks and residual risks following a business disruption.

As when (man-made or human errors) is becoming increasingly common, we are prompting our clients across all industries to review their emergency response and recovery practices in the context of third parties causing or being the source of the “emergency.” We all know time is money and when your systems are offline, that downtime could be costing you significant money in lost revenue and lost employee productivity (think Delta Airlines). The difference between those who are successful and those who struggle during these disruptions is having a formalized, documented business continuity planning program in place that outlines the critical business functions (both in-house and vendor) and allocates specific responsibilities to the key stakeholders within the organization.

A blended approach of adding a business continuity and resiliency lens to your vendor management program can help understand and manage potential disruptions more effectively. This approach ensures that both immediate and long-term risks are identified and mitigated, thereby enhancing the overall stability and sustainability of your operations.

Third-Party Business Impact Analysis

While the objective of a traditional business impact analysis (BIA) is to develop a comprehensive report of all of the departments, systems, and applications in an organization, a third-party BIA will identify critical vendors that need to be included in the business continuity plan. Our Virtual CISOs collaborate with stakeholders within organizations to determine the key business processes (KBP), document these processes, and identify the process owners. We can then help determine the importance of these departments and systems to the operation of the business, the impact of losing data or experiencing downtime, and the impact of time to recover.

Third-Party Business Continuity Plan Development

Based on the results from the third-party BIA, we then begin the process of developing the third-party business continuity plan (BCP). During this phase, our team will perform a risk assessment to identify weaknesses in the current plan and develop a remediation strategy to strengthen the updated plan.

Third-Party Business Continuity Plan Training

The next phase in the program to train your staff on the plan. The goal of this phase in the process is to ensure that your employees know and understand their roles and responsibilities should the plan need to be enacted. This allows for consistency and communication around who is supposed to do what when the time comes, with the goal of reducing any downtime.

Third-Party Business Continuity Plan Testing

Testing or exercising your plan is an often overlooked but critical step in your overall program. Testing of the plan allows for the simulation of an event to determine how well your plan works when it is needed. Testing the plan also allows you to make the necessary adjustments and have a lessons learned exercise to further strengthen your plan and program.

Empower Your Organization for Long-Term Resilience and Stability

Our commitment is to empower your organization with the tools and strategies needed to navigate an increasingly complex and unpredictable landscape. Whether it is through enhancing your vendor management processes, strengthening your business continuity plans, or ensuring your team is prepared to respond effectively in a crisis, our services are built to foster long-term resilience and stability.

If you are ready to take the next step in fortifying your organization against potential threats, we invite you to reach out to us today. Our team of experts is here to guide you through every phase, ensuring that your business is prepared for whatever challenges may come its way. Let us help you build a robust, future-proof strategy that not only meets today’s demands but also anticipates tomorrow’s challenges. Contact us now to learn more about how our vendor management and business continuity planning services can support your organization’s success.