When protecting the company is no longer enough

By León Weinstok

Standfirst: Corporate cybersecurity no longer depends solely on internal controls. León Weinstok examines the risks posed by external providers and the measures companies can take to protect themselves.

For years, companies have focused their cybersecurity efforts primarily on protecting their own infrastructure: defence systems, access controls, staff training and incident response protocols. All of this remains essential, but it is no longer enough.

Business operations increasingly depend on technology providers, cloud platforms, payment processors and other companies that store or process information on behalf of their clients. According to a compilation of statistics published by Exploding Topics, 92% of companies in the Global 2000 use technology outsourcing services.

The risk does not disappear when a third party is hired

Outsourcing a function does not mean outsourcing responsibility.

When a provider manages information, hosts a platform or connects to a company’s systems, its vulnerabilities can become those of its client. The risk increases if the provider subcontracts part of the service, as the company may depend on a chain of third parties it neither knows nor oversees.

The United States National Institute of Standards and Technology, known as NIST, says that supply chain risk management should begin with a due diligence process: investigating the provider before hiring it and throughout the business relationship, assessing its resilience, core cybersecurity practices and the various tiers of its supply chain.

A general confidentiality clause or reliance on a provider’s reputation is therefore not enough. Cybersecurity must be a genuine criterion for selection, contracting and ongoing oversight.

From assurances to evidence

An effective third-party risk management programme should be proportionate to the risk. A courier company does not pose the same risk as a provider that stores personal data, manages credentials, processes payments or administers critical infrastructure.

The first step is to classify third parties according to the information they can access, their connections to systems, their ability to disrupt essential operations and the economic or regulatory consequences of a breach. Companies should then consider, among other measures, the following:

1. Assess providers before hiring them.

The review should examine the provider’s security framework, incident history, continuity plans and how it oversees its subcontractors. A questionnaire is useful, but it should not become a mere formality.

2. Request verifiable evidence.

Depending on the service, companies can request independent audits, penetration tests, certifications such as ISO/IEC 27001, control reports such as SOC 2 or evidence of compliance. Certification does not eliminate risk, but it goes beyond a mere assertion that the provider “follows good practices”.

3. Include clear obligations in contracts.

The contract should set out minimum security controls, rules governing access to and use of information, encryption, conditions for subcontracting, deadlines for reporting incidents, and the secure return or destruction of information when the relationship ends.

It is also important to define the consequences of non-compliance, audit rights and financial liability. An obligation without verification mechanisms or concrete consequences offers more apparent than real protection.

4. Require timely incident reporting.

The contract can also require suspected incidents to be reported and should specify the content of the report, how updates will be provided and the points of contact.

5. Maintain ongoing monitoring.

An initial review is only a snapshot of the provider at a given point in time. Critical providers should be reviewed periodically and whenever the service changes, an incident occurs or access to information is expanded.

6. Review the subcontracting chain.

The company should know whether the provider uses cloud services, data centres or other third parties and, where warranted by the risk, impose the same security obligations on them.

7. Plan for the end of the relationship.

A provider’s departure creates risks if its credentials, copies of information or integrations remain active. Plans should cover the removal of access, the certified return or destruction of data and service continuity.

And when everything fails

Even the most rigorous programme cannot eliminate risk entirely. Certifications can lapse, controls can fail and an unknown vulnerability can affect numerous clients of a provider at once. Prevention must therefore be complemented by continuity plans, incident response protocols and exercises that include scenarios originating with third parties.

It is also important to consider cyber insurance, which, depending on its terms, may cover investigation costs, data recovery, business interruption, legal response, notification and third-party liability.

However, insurance does not replace controls. Before taking out a policy, companies should review its exclusions, limits, deductibles, notification requirements and conditions relating to providers, and assess whether coverage is triggered when an incident occurs in a third party’s infrastructure or through the use of artificial intelligence.