About this module
Every vendor with access to systems, data, or workflows becomes part of the company's risk surface. This module helps managers ask practical questions before a tool, contractor, or service is approved. Learners cover encryption, cyber insurance, breach notification terms, subcontractors, access limits, and contract language. The lesson is not about turning managers into lawyers. It is about making sure security and legal teams are involved before a vendor connection becomes difficult to unwind.
Key takeaways
Every vendor, contractor, or software tool you connect to your systems becomes part of your risk surface, whether you meant it to or not. Security researchers estimate that more than sixty percent of data breaches can be traced back to a third-party vendor, a contractor, or a connected piece of software.
When you grant a vendor access to your data or your network, you are not just signing a contract, you are extending your risk surface into their systems. Start with encryption. If a vendor cannot confirm that your data is encrypted both while it's stored and while it's moving between systems, treat that as a red flag, not a technicality. Ask about cyber insurance.
A vendor with real coverage has already been vetted by an insurer, and it signals they take incidents seriously enough to plan for one. Find out their breach notification time frame, in writing. The difference between finding out in twenty-four hours and finding out in thirty days can be the difference between containing a breach and cleaning up after one.
Ask exactly who on the vendor's side can touch your data, by name or by role, not just, quote, our team. Vague answers here usually mean vague access controls. Request the right to audit them, or at minimum, ask for their most recent security report, so you're not just taking their word for it. Confirm they support M.F.A. and S.S.O. for your administrators.
If a vendor can't integrate with your identity system, every account you create there is a gap you have to manage manually. Six questions, one signature, a lot less risk. Vendor risk isn't a one-time checkbox. At onboarding, you review their security before signing. While they're active, you check in periodically. At renewal, you re-assess instead of rubber-stamping.
And at offboarding, you confirm their access is revoked and your data is deleted. In several real-world incidents, attackers didn't breach the target directly, they breached a vendor first, then rode that vendor's overly broad access straight into dozens of the vendor's customers, all at once. Before any vendor gets access, ask the hard questions.
Once they're in, scope their access as tightly as the job allows. And after that, keep reviewing, on a schedule, not just when something breaks. Even with a great vendor, something can still go wrong. Next, we'll cover incident response, and exactly what your role is as a manager in the first hour.
