The fundamentals of third-party cyber security

Many charities work with contractors who offer an intermittent or regular service such as IT support, accounting, or any number of other roles. According to recent research from Charity Digital, seven in ten charities outsource some or all of their IT provision, with only 15% saying they have adequate internal resources to support their digital strategy. 

Working with contractors, therefore, is vital for charities in a digital age, where technology can push organisations closer to achieving their mission. Though these contractors are not employees and, by and large, do not work on premise, they usually have accounts that access organisational data. That might be within the company network or via a cloud service such as Microsoft 365 or Azure. 

Because contractors have access to your systems and data, it is important that they are not an afterthought when it comes to cyber security. Cyber Essentials, the certification scheme which prescribes five core controls that can protect against the most common cyber threats, states clearly that all devices that access organisational data and services are counted in its assessment. This includes any devices belonging to trustees, governors, volunteers, contractors, and personal devices (Bring Your Own Device (BYOD)) that access work emails and cloud services. 

But how do you apply the Cyber Essentials controls to a contractor’s device? How can charities control things like the router firmware, the operating system, security updates and device locking on a contractor’s laptop? 

The answer to these challenges have three possible solutions. Charities can:  

Below, we explore these options in more detail, showing how charities can mitigate against cyber attacks and minimise the vulnerabilities that may come from working with third-parties.  

How to ensure your contractors are secure 

Option A 

Pass the Cyber Essentials requirements down the supply chain to them.  

The Cyber Essentials controls must be applied to the software or host-based firewall, installed on the contractor’s laptop or computer. Where your organisation does not control the boundary firewall, for example, in a coffee shop, hot desk or conference centre, the host-based firewall on the device will act as the boundary.  

Your contractors may use a virtual private network (VPN). To meet the Cyber Essentials requirements, the only secure option is a corporate VPN which is a direct single tunnel that connects remote workers, including in this example the contractor, back to your charity’s office location, or to a virtual or cloud firewall. The corporate VPN must be administered by your charity so you know that the firewall controls have been applied.  

Access control and passwords  

Contractors will need to follow your charity’s password policy, this will include: 

Your password policy can be achieved by giving guidance to your employees, volunteers and contractors and this can be as you see fit -through policies, procedures, training or technical controls. 

Multi-factor authentication 

When accessing cloud services where the accounts belong to your charity, in addition to a minimum length password of 8 characters, user identity must be confirmed with multi-factor authentication (MFA).  Your contractors will need to use one of the following methods to authenticate their accounts: 

A Bring Your Own Device Policy  

As your contractor’s devices are in scope for your Cyber Essentials certification, your charity will need to take some administrative control over them, treating them as Bring Your Own Devices ( BYOD).  

Charities should therefore adopt a a BYOD policy, addressing the use of personal devices that connect to your organisational networks, and cloud services like Microsoft 365. The contractor/ owner of the device must understand and accept the terms and conditions of the BYOD policy. 

Ideas to include in your BYOD policy 

Technical controls in a BYOD policy 

Although all of your security requirements can be explicitly referenced in your policy and included in your SLA or contract, a written policy cannot substitute applying controls to a BYOD device; technical measures also need to be in place.  

Some of the tricky issues such as managing security updates, software firewall rules, controlling unnecessary accounts, malware protection and application allow listing can be more effectively managed with a technical solution. 

If you are certifying to Cyber Essentials Plus, a sample of devices will be tested for compliance by an Assessor. Even if you are not going for the audit this time, you could always follow this approach and look at a sample as part of your management checks. 

Option C  

An alternative to mandating that your contractors are Cyber Essentials certified or including their personal device within your Cyber Essentials scope, is to provide all your contractors with devices that are managed by your organisation.