CIA Triad Within Vendor Management

Welcome to this week’s Third Party Thursday! My name is Aaron Kirkpatrick and I’m the Information Security Officer here at Venminder. During this video we are going to discuss what the CIA triad is and what it has to do with Vendor Management.

Let’s talk about the core fundamental concepts of information security, the CIA triad of information security. How does my vendor’s approach to CIA - or Confidentiality, Integrity and Availability - affect you and your customers?

What is the CIA Triad?

The CIA Triad is the foundation of information security:

1. Confidentiality seeks to prevent unauthorized disclosure of information.
2. Integrity seeks to ensure that data is not modified by unauthorized means.
3. Availability ensures that information is available when needed and only to authorized personnel.

You are expected to understand your vendor’s approach to security, which is their posture on Confidentiality, Integrity and Availability. 

How do you verify your vendor’s approach?

1. Confidentiality: Can be breached at numerous points along the flow of information. 

• Does your vendor qualify and monitor its employees?
• Does your vendor conduct regular third party assessments to identify potential vulnerabilities?
• Does your contract have a non-disclosure clause?
• Does your vendor encrypt data in-transit and at-rest?
• The amount of data you share with your vendors should correlate to your contractual agreements and other controls on both sides to protect that data.
  

2. Integrity: Financial institutions have to be confident that their data is not modified.

• Has your vendor implemented thorough Logical and Physical Access Controls?
• Does your vendor have a well-formed Backup Policy that’s implemented and effective?
• What data validation checks are performed?
  

3. Availability: Through Service Level Agreements, SOC Reviews, Business Continuity and Disaster Recovery Plan Reviews and Cybersecurity Reviews financial institutions need to have access to their information.

• Are you able to assure your customers that their information is readily available?
• Do you have a Service Level Agreement in place with your vendor and are you sure they meet these commitments?
• Does your vendor have a well-formed Business Continuity and Disaster Recovery Plan?
• Have their plans been updated and tested recently?

To fully understand your vendor’s position on Confidentiality, Integrity and Availability, it’s essential to perform your vendor due diligence. 

Again, I’m Aaron Kirkpatrick and thank you for watching! If you haven't already, please subscribe to the Third Party Thursday series!