As privacy and regulatory compliance becomes critical business priorities, organisations have to ensure that their business partners comply with enterprise security and acceptable use policies. Poorly secured business partners present organisations with unacceptable risks, hence the requirement for third party security risk assessment. This demands that appropriate steps are taken to mitigate any such risk that commensurate with the deemed exposure.

It has become accepted practice for organisations to focus on their core competencies, this drives them to increasingly outsource business functions to third parties or host corporate data with specialist organisations. In doing this, part of the due diligence to be carried out is a third party infrastructure review. This would give the organisation the assurance that these partners will protect information they handle as expected and function the way they need to under the control of legitimate users. We can provide objective and independent assessment of the security posture and profile of partner organisations.

We can assist or guide an organisation in developing a framework for dealing with third party organisations that would ensure that any risk resulting from the relationship is mitigated as appropriate. Without this, it will be difficult for organisations to have the confidence to grant such partners access to their infrastructure and critical business data.

An important factor in product evaluation and assessment is ensuring that the product has been developed following secure coding guidelines and with appropriate security built-in from inception. However the validity and reliability of security functions of this applications or systems need to be proven. This can be by validating them against industry benchmarks or best practices or against agreed common criteria or specification. This can be easily done drawing upon our wide and deep experience of designing and implementing security controls.

We could also carry out health checks on the implementation of security controls to validate that the confidentiality, integrity and availability of corporate information assets supports the business objective. This would cover vulnerabilities in IT systems and networks, insufficient or inappropriate controls or weak security functionality in a product or service.