Answer
Assess third parties through security questionnaires and risk ratings, establish contractual security obligations, implement strict access controls, and maintain ongoing monitoring and compliance verification.
Third-party vendors and subcontractors are integral to modern business operations, but they introduce security risks that organizations must actively manage. When third parties have access to your systems or handle specified information on your behalf, their security weaknesses become your security weaknesses.
CPCSC requirements recognize this reality and mandate comprehensive third-party security management. Understanding how to assess and manage third-party security helps executives build effective risk management programs that extend security throughout the business ecosystem.
Third-Party Risk Landscape
Organizations typically engage numerous third parties in various capacities. The common thread is that third parties represent expansion of your security perimeter—their security controls (or lack thereof) directly impact your security posture and CPCSC compliance.
Third parties in your ecosystem include the following:
- Subcontractors perform specialized work as part of prime contracts and may need access to specified information to complete their work
- Professional services firms provide consulting, development, or support services requiring system access
- Managed service providers operate IT infrastructure, security monitoring, or application hosting on your behalf
- Cloud service providers host systems and data
- Software vendors provide applications used in specified information systems
- Hardware vendors supply equipment
- Business partners collaborate on joint ventures or integrated solutions
Each presents unique risks requiring tailored assessment and management approaches.
Initial Third-Party Security Assessment
Before engaging third parties who will access specified information or systems, conduct security assessments. Define scope of access clarifying exactly what specified information third party will access, what systems they'll connect to, what actions they're authorized to perform, and duration of access.
Your assessment approach should include the following elements:
- Risk classification rates third parties based on access level—those with administrative privileges, broad access to specified information, or critical service roles warrant thorough assessment while those with limited, supervised access might require lighter evaluation
- Security questionnaires tailored to third-party role ask relevant questions about information security policies, access controls, personnel security, encryption, incident response, business continuity, and other ITSP.10.171 families as applicable
- Documentation review examines third-party security policies, procedures, and certifications (ISO 27001, SOC 2, etc.)
- Technical assessment for high-risk third parties might include reviewing network architecture, testing authentication mechanisms, evaluating encryption implementations, or conducting vulnerability assessments
- References from other clients provide insights into third-party security practices and responsiveness
Assessment findings should be documented, risks identified, and mitigation requirements specified before granting access.
Security Requirements in Third-Party Agreements
Third-party contracts must explicitly address security obligations. Security terms should be non-negotiable for high-risk third parties—if they won't commit to appropriate security, they shouldn't be engaged for specified information work.
Key contractual security provisions include:
- Scope statement clearly defines what specified information third party may access and for what purposes, establishing boundaries
- Security controls specify which ITSP.10.171 requirements apply to third party based on their role—requirements should flow down proportionally to risk
- Data protection obligations include encryption, access controls, physical security, and prohibition on unauthorized use or disclosure
- Personnel requirements mandate background checks, security training, and NDAs for third-party personnel accessing specified information
- Incident notification requires third party to promptly report security incidents, breaches, or suspected compromises affecting your information
- Audit rights allow you to verify third-party security compliance through audits, assessments, or review of control evidence
- Subcontracting restrictions prohibit or require approval before third party engages their own subcontractors, with security flow-down
- Data return and sanitization upon contract completion with verification
- Right to disconnect allows immediate termination of third-party access if security incidents or violations occur
- Liability provisions address consequences of third-party security failures
Access Management for Third Parties
Third-party access requires careful controls beyond those for employees. Prompt revocation when services end or personnel change is critical—many breaches involve stale third-party access that wasn't properly deactivated.
Implement these access control measures:
- Unique credentials for each third-party user rather than shared accounts enable accountability and access tracking
- Least privilege access grants only specific permissions needed for third party's work, not broad administrative access
- Multi-factor authentication required for all third-party remote access adds security beyond passwords
- Time-limited access that automatically expires after defined period prevents indefinite access accumulation
- Supervised access for highest-risk activities requires third-party personnel to perform sensitive activities only while under observation of your personnel
- Privileged access management systems broker and monitor third-party administrative access, recording sessions and enforcing approvals
- Network segmentation isolates third-party access to specific systems or zones rather than allowing broad network access
- Separate third-party VPN or access gateway distinct from employee access enables differentiated security policies and monitoring
- Regular access reviews verify third parties still require access and permissions remain appropriate
Ongoing Third-Party Monitoring
Initial assessment isn't sufficient—risks evolve throughout relationships. Ongoing monitoring identifies degrading security posture before incidents occur and informs renewal decisions.
Maintain continuous oversight through these activities:
- Continuous monitoring reviews third-party security logs for suspicious activity, unusual data access, or policy violations
- Security performance tracking monitors whether third parties follow security procedures, respond appropriately to incidents, and complete required training
- Relationship management through regular meetings discusses security issues, reviews incidents or near-misses, and addresses concerns
- Periodic reassessment (annually or triggered by significant changes) repeats security evaluation to verify continued compliance
- Third-party security scorecards rate performance across metrics like incident frequency, assessment findings, response times, and control compliance
- Industry monitoring tracks third-party reputation, security incidents affecting other customers, or financial instability
- Contract compliance audits verify third parties satisfy contractual security obligations
- For critical third parties, consider requiring they complete annual security attestations or submit to independent security assessments
Managing Subcontractor Relationships
When your subcontractors engage their own subcontractors, security becomes more complex. The challenge is maintaining security visibility and control as supply chains become longer and more complex—clear contractual requirements and active oversight are essential.
Address downstream subcontractor risks through these mechanisms:
- Contractual flow-down requires your security requirements to cascade to subcontractors' subcontractors, maintaining consistent security through the chain
- Transparency requirements mandate subcontractors disclose their subcontractors, what access they'll have, and where they're located
- Approval rights allow you to review and approve or reject proposed subcontractors before engagement
- Right to assess extends your audit and assessment rights to downstream subcontractors
- Liability chain holds your direct subcontractor responsible for downstream subcontractor security, incentivizing them to manage their own subcontractors effectively
Organizations should map entire supply chains for specified information work, understanding all parties with potential access. For highly sensitive work, contracts might prohibit subcontracting entirely or limit to pre-approved subcontractors only.
Third-Party Incident Response
Security incidents involving third parties require coordinated response. Organizations should test third-party incident response coordination through tabletop exercises, ensuring communication channels work and responsibilities are clear.
Establish these incident response protocols:
- Notification obligations require third parties to promptly inform you of any incidents affecting your information or systems—contracts should specify notification timeframes (e.g., within 24 hours of discovery)
- Information sharing during incidents includes coordination between your incident response team and third-party teams, sharing indicators of compromise, and collaborative investigation
- Access suspension during incidents might require immediately disabling third-party access if compromise is suspected until investigation determines safety of restoration
- Recovery assistance requires third parties to cooperate with incident response, provide forensic evidence, and assist remediation efforts
- Post-incident review examines what happened, why security controls failed, and what improvements are needed
- Responsibility and liability questions about who bears costs, whether contractual commitments were breached, and what remediation is required should be addressed through contracts before incidents occur
Special Considerations for Foreign Third Parties
Third parties located outside Canada introduce additional considerations for specified information. For highly sensitive specified information, limiting to Canadian third parties might be prudent or even contractually mandated by your customer.
Evaluate these additional risk factors for foreign third parties:
- Data sovereignty concerns arise if third-party work requires transferring specified information to foreign countries where different legal frameworks apply
- Legal jurisdiction questions affect whether Canadian law governs disputes and whether foreign governments might compel disclosure
- Foreign Ownership, Control, or Influence (FOCI) considerations for third parties owned or controlled by foreign entities require assessment of potential compromise or influence
- Export control compliance ensures work doesn't violate Canadian export controls on defense technology
- Personnel security challenges emerge if third-party personnel are foreign nationals potentially subject to foreign intelligence services
- Time zone and language barriers can complicate security coordination and incident response
For specified information work, organizations should carefully assess whether foreign third parties are appropriate or whether Canadian-based providers should be required. Contracts with foreign third parties must explicitly address data sovereignty, legal jurisdiction, and security requirements.
Third-Party Personnel Security
Third-party employees accessing specified information require personnel security measures similar to your own employees. Organizations should maintain records of third-party personnel who have accessed specified information for security tracking and incident investigation.
Apply these personnel security controls to third-party staff:
- Background checks proportional to access sensitivity—those accessing specified information should undergo checks comparable to your own personnel
- Security clearances might be required if third-party personnel will access classified information in addition to specified information
- Security training ensures third-party personnel understand security requirements, recognize threats, and know reporting procedures—don't assume third parties train their personnel adequately
- Non-disclosure agreements signed by individual third-party personnel, not just corporate entities, create personal accountability
- Personnel change notification requires third parties to inform you when personnel with access to your systems change, enabling you to update access controls
- Insider threat awareness recognizes that third-party personnel are potential insider threats just like employees—monitoring and behavioral detection should include them
Third-Party Risk Management Program
Effective third-party security requires programmatic approaches, not ad-hoc efforts. Mature third-party risk management programs demonstrate strong security culture and satisfy CPCSC Level 2 assessment expectations.
Build a comprehensive program with these components:
- Governance structure assigns executive sponsor, designates third-party risk management team, defines roles and responsibilities, and establishes policies and procedures
- Third-party inventory maintains complete list of all third parties with system access or handling specified information, their risk ratings, and access scope
- Risk-based approach applies rigorous assessment to high-risk third parties while streamlining evaluation for lower-risk parties—not all third parties warrant equal effort
- Standardized processes use consistent questionnaires, assessment procedures, contract templates, and onboarding workflows
- Technology solutions like third-party risk management platforms automate questionnaire distribution, track assessment status, store documentation, monitor ongoing risk, and generate reports
- Integration with procurement ensures security assessment occurs before contracts are signed rather than as afterthought
- Metrics and reporting track number of third parties, risk ratings, assessment coverage, findings, incidents, and trends for management visibility
- Continuous improvement reviews program effectiveness, incorporates lessons from incidents, and adapts to evolving threats
Challenges and Practical Considerations
Organizations face challenges implementing third-party security. Organizations should develop pragmatic programs appropriate to their size and risk while demonstrating reasonable due diligence. Perfect third-party security is impossible, but structured programs significantly reduce risk.
Address these common challenges:
- Resource constraints particularly for small and medium contractors make comprehensive assessment of every third party impractical—risk-based prioritization is essential
- Third-party resistance to security requirements occurs when they view requirements as onerous or inconsistent with their business model—clear communication of non-negotiable requirements for specified information work is important
- Existing relationships where contracts lack security terms and renegotiation is difficult require working within constraints, potentially adding security addendums or implementing compensating controls
- Sole-source suppliers where alternatives don't exist create dependency that limits leverage—accept residual risk, implement enhanced monitoring, or find alternatives if feasible
- Balancing security and business agility given that rigorous third-party assessment takes time while business wants rapid vendor onboarding requires finding balance through streamlined but effective processes
Learn More
Additional resources on third-party security management:
