Security For Outsourced IT Contracts

•Als PPT, PDF herunterladen•

0 gefällt mir•544 views

The document discusses managing security risks when information technology functions are outsourced to third parties. It covers planning for outsourcing contracts, including assessing security risks, requirements for vendors, and contract terms. It also discusses selecting vendors, administering contracts over time through reviews and audits, and ensuring proper termination of contracts and systems access. Managing security is key throughout the outsourcing lifecycle from initial planning through contract completion.

Bill Lisse, CISSP, CISA, CGEIT, PMP, G7799 Corporate Information Security Officer 1/19/2011 Managing Security in Outsourced Information Technologies

Overview ,[object Object],[object Object],[object Object],[object Object],[object Object],Risk is always involved when third-party entities are given access to sensitive customer data, privileged business operation details, or intellectual property vulnerable to public or competitor disclosure.

Shifting Sands ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Planning ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Planning is the most critical phase of IT contract management – information security should be built into the contract at its inception.

Planning ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Planning ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Key issues can range from requiring the vendor to maintain specified levels of security through employee awareness training and contractual obligations and company indemnification by the vendor for any breaches.

Planning ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Source Selection and Award ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Contract Administration ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Contract Termination ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],Don’t neglect contract termination; residuals and loose ends are real security risks.

Conclusion ,[object Object],[object Object],[object Object],[object Object],[object Object]

References ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Empfohlen

William A. Tanenbaum Association of Benefit Administrators April 2015William Tanenbaum

Setting up an Effective Security and Compliance OfficeCloud Watchmen Inc.

Organizational Resilience Management - an Integrated GRC ApproachPECB

Finding a Strategic Voice - IBM CISO StudyIBMGovernmentCA

PECB Webinar: Why every company needs a CISO?PECB

CISO Case Study 2011 V2candy_alexander

How to Build and Implement your Company's Information Security ProgramFinancial Poise

Robert beggs incident response teams - atlseccon2011Atlantic Security Conference

Empfohlen

William A. Tanenbaum Association of Benefit Administrators April 2015William Tanenbaum

Setting up an Effective Security and Compliance OfficeCloud Watchmen Inc.

Organizational Resilience Management - an Integrated GRC ApproachPECB

Finding a Strategic Voice - IBM CISO StudyIBMGovernmentCA

PECB Webinar: Why every company needs a CISO?PECB

CISO Case Study 2011 V2candy_alexander

How to Build and Implement your Company's Information Security ProgramFinancial Poise

Robert beggs incident response teams - atlseccon2011Atlantic Security Conference

Data Protection Indonesia: Basic Regulation and Technical Aspects_ErykEryk Budi Pratama

Compliance IT Project CategoriesMark Ritchie

Procurement & Government Contracting Compliance (Series: Corporate & Regulato...Financial Poise

BSIDES DETROIT 2015: Data breaches cost of doing businessJoel Cardella

Cyber Insurance CLE Sarah Stogner

Dit yvol5iss36Rick Lemieux

Data protection services lifecycle approach to critical information protectionAujas Networks Pvt. Ltd.

Third-Party Risk ManagementMark Scales

Offshore servicesBrizGo

Development of Digital Identity Systems Maganathin Veeraragaloo

Third Party Compliance: Issues and Strategies to Mitigate Corruption Related ...Dan Reynolds, CPA, CFE, CAMS

Core Elements of Retail LP Shortened version 15MBAlan Greggo

Dlp Methodologytbeckwith

Information technology riskssalman butt

The Increasing Problems Of Controlling AccessKylie Dunn

Planning A Secure Partner PortalLeo de Sousa

Winning Tactics for Data GovernanceColleen Beck-Domanico

Data Privacy, Information Security, and Cybersecurity: What Your Business Nee...PECB

CBIZ Cyber Liability FlyerCBIZ, Inc.

Master Class Cyber Compliance IE Law School IE Busines SchoolHernan Huwyler, MBA CPA

Globalizing management education_issues_&_challenges_for___industry_&...Tweena Pandey

Absenteeism and performance the challenge of summer 2012 eventsMike Morrison

Weitere ähnliche Inhalte

Was ist angesagt?

Data Protection Indonesia: Basic Regulation and Technical Aspects_ErykEryk Budi Pratama

Compliance IT Project CategoriesMark Ritchie

Procurement & Government Contracting Compliance (Series: Corporate & Regulato...Financial Poise

BSIDES DETROIT 2015: Data breaches cost of doing businessJoel Cardella

Cyber Insurance CLE Sarah Stogner

Dit yvol5iss36Rick Lemieux

Data protection services lifecycle approach to critical information protectionAujas Networks Pvt. Ltd.

Third-Party Risk ManagementMark Scales

Offshore servicesBrizGo

Development of Digital Identity Systems Maganathin Veeraragaloo

Third Party Compliance: Issues and Strategies to Mitigate Corruption Related ...Dan Reynolds, CPA, CFE, CAMS

Core Elements of Retail LP Shortened version 15MBAlan Greggo

Dlp Methodologytbeckwith

Information technology riskssalman butt

The Increasing Problems Of Controlling AccessKylie Dunn

Planning A Secure Partner PortalLeo de Sousa

Winning Tactics for Data GovernanceColleen Beck-Domanico

Data Privacy, Information Security, and Cybersecurity: What Your Business Nee...PECB

CBIZ Cyber Liability FlyerCBIZ, Inc.

Master Class Cyber Compliance IE Law School IE Busines SchoolHernan Huwyler, MBA CPA

Was ist angesagt? (20)

Data Protection Indonesia: Basic Regulation and Technical Aspects_Eryk

Compliance IT Project Categories

Procurement & Government Contracting Compliance (Series: Corporate & Regulato...

BSIDES DETROIT 2015: Data breaches cost of doing business

Cyber Insurance CLE

Dit yvol5iss36

Data protection services lifecycle approach to critical information protection

Third-Party Risk Management

Offshore services

Development of Digital Identity Systems

Third Party Compliance: Issues and Strategies to Mitigate Corruption Related ...

Core Elements of Retail LP Shortened version 15MB

Dlp Methodology

Information technology risks

The Increasing Problems Of Controlling Access

Planning A Secure Partner Portal

Winning Tactics for Data Governance

Data Privacy, Information Security, and Cybersecurity: What Your Business Nee...

CBIZ Cyber Liability Flyer

Master Class Cyber Compliance IE Law School IE Busines School

Andere mochten auch

Globalizing management education_issues_&_challenges_for___industry_&...Tweena Pandey

Absenteeism and performance the challenge of summer 2012 eventsMike Morrison

Intelligent Security, Compliance and Privacy in Office 365Miguel Isidoro

Cybersecurity R&D briefingNaba Barkakati

Security Administration IntroCarter F. Smith, J.D., Ph.D.

Peter Cheese webinar slides April 2013Mike Morrison

Unpacking Intuition - Prof Sadler-SmithMike Morrison

080529 yashima ppfinal [compatibility mode]MoonKJun

Human security introduction by dr. ghassan shahrourGhassan Shahrour

PPM Security Manifesto - Gulhigen #Olhuvaalimanifesto Badruddeen

Building Up Network Security: Intrusion Prevention and SourcefireGlobal Knowledge Training

Watermarking & EncryptionHossam Halapi

ISSA Data Retention Policy DevelopmentBill Lisse

9 June 2009 المحاضرة INFOSECDr. Paul Coleman

التشفيراصفر احمر

أساليب تشفير البيانات، بناء مقاطع التشفيرOmar Alabri

4 أنواع خوارزميات التشفيررياض خليفة

Cisco network security Chapter7Khalid Al-wajeh

Mutual exclusionDillip Behera

The State Of Information and Cyber Security in 2016Shannon G., MBA

Andere mochten auch (20)

Globalizing management education_issues_&_challenges_for___industry_&...

Absenteeism and performance the challenge of summer 2012 events

Intelligent Security, Compliance and Privacy in Office 365

Cybersecurity R&D briefing

Security Administration Intro

Peter Cheese webinar slides April 2013

Unpacking Intuition - Prof Sadler-Smith

080529 yashima ppfinal [compatibility mode]

Human security introduction by dr. ghassan shahrour

PPM Security Manifesto - Gulhigen #Olhuvaalimanifesto

Building Up Network Security: Intrusion Prevention and Sourcefire

Watermarking & Encryption

ISSA Data Retention Policy Development

9 June 2009 المحاضرة INFOSEC

التشفير

أساليب تشفير البيانات، بناء مقاطع التشفير

4 أنواع خوارزميات التشفير

Cisco network security Chapter7

Mutual exclusion

The State Of Information and Cyber Security in 2016

Ähnlich wie Security For Outsourced IT Contracts

Outsourcing Security ManagementNick Krym

Presentation to Irish ISSA Conference 12-May-11Michael Ofarrell

Procurement Of Software And Information Technology ServicesPeister

David Whitaker: Managing Your VendorsElectronic Signature & Records Association

M014 Confluence Presentation 08 15 06gbroadbent67

Information Security Program & PCI Compliance Planning for your BusinessLaura Perry

Class 2003 05 22FNian

DLPsaurabh.sood

SOC presentation- Building a Security Operations CenterMichael Nickle

CRS Company Overview -Feb 6 2017Joseph John

Info Security & PCI(original)NCTechSymposium

Tft2 Task3 EssayMichelle Bojorquez

Emerging Trends in Information Privacy and SecurityJessica Santamaria

WITDOM Credit Risk Scoring use case at ISSE 2017Elsa Prieto

Positive Hack Days. Christopher Gould. Head in the Clouds…Can we overcome sec...Positive Hack Days

Rothke rsa 2012 building a security operations center (soc)Ben Rothke

Proteus OCM Company ProfileKGanzy

From Business Architecture to Security ArchitecturePriyanka Aash

Ca world 2007 SOC integrationMichael Nickle

Ähnlich wie Security For Outsourced IT Contracts (20)

Outsourcing Security Management

Presentation to Irish ISSA Conference 12-May-11

Procurement Of Software And Information Technology Services

David Whitaker: Managing Your Vendors

M014 Confluence Presentation 08 15 06

Information Security Program & PCI Compliance Planning for your Business

Class 2003 05 22

DLP

SOC presentation- Building a Security Operations Center

CRS Company Overview -Feb 6 2017

Info Security & PCI(original)

Tft2 Task3 Essay

Emerging Trends in Information Privacy and Security

WITDOM Credit Risk Scoring use case at ISSE 2017

Positive Hack Days. Christopher Gould. Head in the Clouds…Can we overcome sec...

Rothke rsa 2012 building a security operations center (soc)

Proteus OCM Company Profile

From Business Architecture to Security Architecture

Ca world 2007 SOC integration

Security For Outsourced IT Contracts

1. Bill Lisse, CISSP, CISA, CGEIT, PMP, G7799 Corporate Information Security Officer 1/19/2011 Managing Security in Outsourced Information Technologies

10.

11.

12.

13.

14.