IT Security Risk Control Management: An Audit Preparation Plan

© Raymond Pompon 2016

Raymond Pompon, IT Security Risk Control Management, 10.1007/978-1-4842-2140-2_23

23. Third-Party Security

Raymond Pompon¹ 

(1)Seattle, Washington, USA

Doveryai no proveryai. (Trust, but verify.)

—Russian proverb used by President Ronald Regan during arms control negotiations with Russian President Mikhail Gorbachev in the 1980s.

Every organization is dependent on other organizations outside of itself. It’s unlikely that your organization writes all of its own software, builds its own hardware, owns the buildings it occupies, and is an internet service provider. Your security is dependent on many of these things but if they are produced outside of your organization, your control is limited. Previous chapters touched on risk and ...