Their risk is your risk and vice versa

The dependence of larger organizations to succeed is with their supply chain and third party providers. Organizations are always reviewing if a function makes sense to be in house as a full time employee or outsourced to a provider. Maybe the skill set is so niche that it's hard to attract the talent or perhaps the need for those skills is a short term play. Either way, organizations will have to rely on an outside party at some point to provide them with services that they need to appeal and support their own customers.

Large organizations have identified their risk and move to secure their posture. They have the resources to attempt to do this. It's for another article to discuss how the current state that most companies go about doing this isn't sufficient to actually address risk; more of a compliance play to show anyone that they are at least performing due diligence.

Smaller organizations don't have the funds or the means or even the insight and guidance to be able to do so. This actually causes a level of risk for the larger organizations that has been largely ignored up until now. Boards are beginning to ask the questions about what's the supply chain look like and what is management going to do about it.

Do something about it

I believe the best strategy for a small or mid sized business is to layout a clear and attainable security posture to showcase to anyone. This needs to be easily articulated to the larger organization's CISO, GRC or contracts team as these groups will have prescribed standards that the smaller organizations will have to meet. They may ask your 25-100 employee firm to attest to and produce a SOC 2 Type II. These types of compliance based independent audits are outside of being a reasonable expense.

NIST created a lighter version of controls built more for small businesses. These 20 controls are more in line with the what a smaller organization is at risk for and what they can actually address. Read this publication at the link below or use this breakdown chart we use on engagements with clients.

Just because your smaller doesn't mean you can't address risk appropriately. And just because your larger doesn't mean those standards that you're held too should be the same of your suppliers and vendors. Right size it. That's the essence of risk management.

Brian Haugli is a Partner at Side Channel Security and former CISO for a Fortune 500. Side Channel delivers vCISO services and cyber security, risk management, and strategy tailored to small-mid size enterprises, VC backed software firms, and non-profits. Basically all the most underserved organizations when it comes to risk management.