Managed Service Providers (MSPs); things to consider:
Evaluate data security measures
Ensure confidentiality and integrity
Assess cybersecurity protocols
Response to security breach
Supply Chain Attacks
Attack that involves targeting a weaker link in the supply chain to gain access to a primary target.
You are only as strong as the weakest link in the supply chain (e.g., preinstalled malware).
CHIPS Act: US federal statue that provides roughly 280 billion to boost research and manufacturing of semiconductors in the US. Goal is to reduce supply chain risk in semiconductors.
Defense:
Vendor Due Diligence
Regular Monitoring and Audits of Supply Chain
Education and Collaboration
Incorporating Contractual Safeguards
Vendor Assessment
Process that organizations implement to evaluate security, reliability, and performance of external entities.
Vendors: Businesses or individuals that provide goods or services to an organization.
Suppliers: Individuals involved in the production and delivery of products or parts of products.
Managed Service Providers: Individuals hired by companies to manage IT services on behalf of an organization.
Penetration Testing: Simulated cyberattack against suppliers system to check for exploitable vulnerabilities.
Right to audit clause grants organizations right to evaluate vendors.
Internal Audit: Vendor’s self assessment where they evaluate their own practices against industry standards or organizational requirements.
Independent Assessment: Evaluation conducted by third-party entities that have no stake in the organization’s or vendor’s operations.
Vendor Selection and Monitoring
Due Diligence: Rigorous evaluation that goes beyond surface-level credentials; checks:
Financial stability
Operational history
Client testimonials
On the ground practices
Conflict of Interest: When personal or financial relationships could potentially cloud the judgement of individuals involved in vendor selection. Organizations should always strive to achieve transparency.
Vendor Questionnaires: Comprehensive documents that potential vendors fill out to offer insights into the operations, capabilities, and compliance. (e.g., asking data redundancy, security protocols, uptime guarantees, disasters recovery plans).
Rules of Engagement: Guidelines that dictate terms of interaction between an organization and its potential vendors. (e.g., communication protocols, data sharing policies, negotiation boundaries).
Monitoring: Mechanism to ensure that chosen vendor still aligns with organizational needs and standards.
Feedback Loops: Two-way communication channel where both organization and vendor share feedback.
Contracts and Agreements
Basic Contract: Versatile tool that formally establishes a relationship between two parties.
Service-Level Agreement (SLA): Standard of service a client can expect from a provider. (e.g., no more than 2 hours of downtime per-month; deviation results in penalties).
Memorandum of Agreement (MOA): Formal and outlines specific responsibilities and roles of the involved parties. (e.g., who does content creation, who does distribution, who funds the campaign).
Memorandum of Understanding (MOU): Less binding and more declaration of mutual intent. Usually to signal intent to work together in the future without laying down specific details.
Master Service Agreement (MSA): Blanket agreement that covers general terms of engagement between parties across multiple transactions. Useful for a recurring client relationship when you do not want to draft a new contract for every project.
Statement of Work (SOW): Used to specify details for a particular project. Contains deliverable, timelines, and milestones.
Non-Disclosure Agreement (NDA): Commitment to privacy that ensures that any sensitive information shared during negotiations remains confidential between both parties.
Business Partnership Agreement (BPA): Document that goes a step beyond the basic contract when two entities decide to pool their resources for mutual benefit.