Your vendors are your attack surface

Your security doesn't stop at your own walls. The IT provider with admin access to your systems, the SaaS app holding your customer list, the payroll processor, the bookkeeper, the marketing tool wired into your inbox — each one is a door into your business that someone else controls. When they're breached, your data goes with them, and you often find out last.

You can't audit everyone. But you can get the relationship between your business and its vendors out of people's heads and into something you actually manage.

Start with a list you can see

You can't manage what you can't name. Build a simple vendor register — a spreadsheet is fine to start — and for each vendor capture: what they do, what data of yours they touch, how critical they are if they go down, and who owns the relationship internally. The act of listing them usually surfaces forgotten tools and "shadow IT" no one approved.

Half of third-party risk management is just knowing who your third parties are. Most small businesses have never written the list down.

Right-size the scrutiny

Not every vendor deserves the same attention. Focus on the ones that touch sensitive data or could halt your operations. For those that matter, before you sign — and periodically after — confirm a few basics:

• Do they enforce MFA and reasonable access controls on their side?
• Is your data encrypted in transit and at rest?
• Do they have a security attestation (e.g. SOC 2) or can they answer a short security questionnaire credibly?
• What's their breach-notification commitment — will they tell you promptly if they're compromised?

Put it in the contract

For vendors handling your sensitive data, your agreement should require them to protect it, to notify you of a breach within a defined window, and to handle or return your data appropriately when the relationship ends. A breach-notification clause turns "we hope they'll tell us" into an obligation.

Reduce the blast radius

Assume a vendor will eventually be breached and limit what that costs you: give each tool only the access it truly needs, turn off integrations you no longer use, and remove access promptly when you stop using a service or a contact leaves. The fewer keys you hand out, the smaller the damage when one is stolen.

Securidigm provides advisory cybersecurity services and prepares draft documents. It does not provide an audit, a certification, or legal advice. This article is general information, not advice for your situation, and no outcome is guaranteed.