What to demand from your IT provider
Jan 31st, 2024 by Jesper Kråkhede
After the ransomware attack on a large IT provider in Sweden last week, many managers are asking the same question: What should we have demanded from our provider?
Here is my list.
Separation. Your environment should be separated from other customers, technically and administratively. Ask how many of the provider´s admins can reach your systems, and whether an attacker who gets into one customer can reach the next.
Protected administration. The provider´s admin accounts and admin devices are Tier 0 for you. Demand a second factor, dedicated admin workstations and just in time access.
Backups you control. Demand copies of your data that are stored separately, can´t be deleted by the provider´s admins and are regularly tested for restore.
Transparency. The right to see the logs of what the provider does in your environment, and the right to audit. Notification within hours when they have an incident, even before they know if you are affected.
Continuity. A documented and tested plan for how your critical services are restored, in what order and how fast. And a plan for how you can leave the provider if you need to.
Price it in. All of this costs money, and the cheapest bid usually doesn´t include it. Put the requirements in the procurement, not in a later negotiation.
The new rules in the NIS2 directive will soon make many of these requirements mandatory anyway. Start now.
Choose your provider like you choose your bank. You are trusting them with your business.