The vendor should provide a review of their cybersecurity protection program

This should include:

• how often they have external, objective cybersecurity assessments done
• how they screen their personnel who will be handling your data
• how they monitor their own business partners from a cybersecurity perspective
• how they test their own applications to ensure they are secure
• what security governance policies they have in place and are enforcing

They may possibly even provide you with the results of their most recent cybersecurity assessment.

What has the vendor done to fix critical issues in the past?

Ask your partner what they've done, since their most recent cybersecurity assessment, to remediate any critical or high-risk issues they found.

How will your partners will tell you if there's a cyber threat? 

Get this in writing. Find out how the vendor will notify you of a cyber incident at their organization and how quickly that notification will occur. 

Confirm they'll take responsibility for threats

When setting requirements with a potential vendor, make sure tbhy agree to being responsible for all of their costs relating to a cybersecurity incident and all of your costs if the incident happened as a result of the vendor falling victim to a cyberattack.

Make sure they've got insurance

The vendor should provide proof of enough cyber insurance to cover potential breaches or losses of your data.

How much downtime if there's an incident?

Make sure you outline this in a written agreement.

This is especially important if you have outsourced time critical processes such as payroll or governmental reporting and their outage will cause you to be late delivering those services or artifacts.

This requirement tells the vendor what their backup and disaster recovery schedules need to accommodate.

Ask to see their data retention plan

The vendor must have a data retention plan that you agree with for all data and actions relating to your data.

They should also be willing to return all of your data if your contract with them is terminated for any reason, and they must have the same rule in place for any third-party providers they deal with.

Last, the vendor must be required to destroy all of your data residing anywhere on their systems after providing you with copies of that data upon contract termination and they must have the same rule in place for any third-party providers they deal with.

Monitor vendor performance, manage third-party cyber risk

Once you've contracted with a vendor, you should routinely monitor their performance to ensure they are meeting your contractual cybersecurity requirements. You can do this in several ways including:

• Reviewing daily, weekly, or monthly reports from the vendor’s cybersecurity monitoring tools to show their protections are in place and working.
• Physically auditing the vendor site and performing your own cybersecurity review and/or assessment.
• Asking the vendor to provide annual copies of approved third-party cybersecurity assessments.
• Contracting with your own cybersecurity experts to do penetration testing against your vendor (with your vendor’s knowledge that the tests are occurring of course).