Vendor and third-party security risk for small businesses

Why vendor risk lands on your business

Vendor risk lands on you because the law and your clients treat the data your suppliers hold as yours. Under PIPEDA, an organization is responsible for personal information in its possession or custody, including information transferred to a third party for processing, and it must use contractual or other means to provide a comparable level of protection while the third party processes it.¹ The Privacy Commissioner's guidance on transfers for processing names the contract as the primary means.²

A small office often has more suppliers with access than staff: the managed IT provider with remote control of every computer, the bookkeeping firm in the accounting system, the website developer with the hosting password, the cloud apps that keep client files. Each of them is a door into your systems, and a weak password at the supplier opens it as surely as one of your own.

Third-party risk management: what the law asks of your contracts

Third-party risk management starts with the contract, because that is where both federal and Quebec law put the protection. For a business carrying on an enterprise in Quebec, section 18.3 of the private-sector Act requires the mandate or service contract to be in writing and to set out the measures the provider must take to keep the information confidential, to use it only for the contract and to stop keeping it once the contract ends.³

The same section obliges the provider to notify your person in charge of the protection of personal information without delay of any violation or attempted violation of those confidentiality obligations, and to let that person carry out any verification of the confidentiality requirements.³ When the provider keeps the information outside Quebec, section 17 adds a privacy impact assessment and a written agreement that reflects its results.³

The wording of those clauses belongs to your lawyer. Our part is the security content: what the supplier actually does with your data, which protections are realistic for it, and which points the lawyer should see in the draft. For the privacy side of your own business, see PIPEDA and Quebec Law 25 compliance.

Vendor risk assessment: ranking suppliers by data and access

A vendor risk assessment ranks each supplier by two questions: what information it holds and what it can reach in your systems. The Canadian Centre for Cyber Security uses the same logic for technology suppliers: first rate the sensitivity of what the supplier touches as low, medium or high, then assess your confidence in the supplier, then decide whether the remaining risk is acceptable, needs stronger mitigation or calls for another supplier.⁴

Ranking keeps the work proportionate. A supplier with administrator access to every computer gets a close look and a contract review; a supplier that only receives your office address gets a line in the register. NIST's framework expresses the same idea as suppliers known and prioritized by criticality,⁶ and its full supply chain guidance, SP 800-161 Rev. 1, scales the practice up for large organizations.⁷

Vendor security questionnaire and the evidence worth asking for

A vendor security questionnaire is useful when the answers are backed by evidence the supplier can show. Independent reports carry more weight than self-declared answers: a SOC 2 report from a CPA firm, an ISO/IEC 27001 certificate from an accredited certification body, or CyberSecure Canada certification. The Cyber Centre's baseline controls go further for cloud services and ask small organizations to require that all their cloud service providers share an AICPA SSAE 18 SOC 3 report stating that they achieved Trust Service Principles compliance.⁵

We send each high and medium supplier a short set of questions written for your situation, read what comes back, and compare it with what we see on your side: whether the supplier's accounts use multi-factor sign-in, which of its staff can reach your systems, where your data is stored and what happens to it when the contract ends. The baseline controls also ask for two-factor authentication on cloud administrative accounts and for comfort with the legal jurisdictions where outsourced vendors keep or process sensitive data.⁵

• Independent reports: SOC 2, ISO/IEC 27001 certificate, CyberSecure Canada
• Who at the supplier can reach your data or systems, and how they sign in
• Where the data is kept, including outside Quebec or Canada
• Subcontractors that also receive your data
• How fast the supplier tells you about an incident, and who it calls
• Return or deletion of your data when the contract ends

Supplier access on your side: the part most reviews skip

The fastest gains in vendor risk come from your own systems, where supplier access is easy to see and easy to fix. Former contractors keep working accounts, a website developer still holds the hosting administrator password, a remote support tool stays installed long after the support contract changed.

We list every account, remote access tool and shared password a supplier uses, check multi-factor sign-in and permissions, and remove what is no longer needed, with your approval for each change. Where your mail and files live in Microsoft 365 or Google Workspace, guest and partner access is part of this review, and the full tenant check has its own page.

When a key vendor fails the review

A key vendor that fails the review gets a plan with dates, and replacement is the last step. The Cyber Centre's method ends with three outcomes: the risk is acceptable, stronger mitigations are needed, or another technology or supplier should be chosen.⁴

In practice we write down the gap, ask the supplier for a date to close it, and add measures on your side in the meantime, such as narrower access, multi-factor sign-in on the supplier's accounts or a separate backup of the data it holds. NIST's framework lists two related outcomes: relevant suppliers included in incident planning, response and recovery, and plans that cover what happens after a service agreement ends.⁶ Those two points go into your incident response contacts and the exit terms your lawyer drafts.

What our vendor risk management service includes

Our vendor risk work starts with a 30-minute conversation and a scope letter that names the suppliers, the systems and the dates. We assess suppliers only through what they choose to share and through your own systems; an audit at a supplier's premises needs its consent and its own scope letter.

What you have in hand afterwards

You finish with records that answer the questions clients, insurers and regulators ask about your suppliers. The report belongs to your business.

• A supplier register with risk tier, data held and access granted
• An evidence file for each key supplier, with gaps and dates
• A record of the supplier access we changed on your systems
• Contract requirements per key supplier, ready for your lawyer
• A review plan: which suppliers to revisit, and when