Navigating the IT market with due diligence

Lee Kim, JD, CISSP, CIPP/US, FHIMSS, Director of Privacy and Security, HIMSS North America, was lead author of this peer-reviewed article. 

Choosing the right technology product or service may seem like a daunting task, especially with cybersecurity vulnerabilities being discovered every day. No one wants to be in a position where a newly purchased product or service is used as a back door by hackers to breach agency information systems and networks.

While technology procurement is not easy, there is a methodology that can be applied to help IT managers choose the appropriate product or service by taking into account business, technical and legal due diligence considerations.

Business Due Diligence

Business diligence essentially involves evaluating the vendor by learning about the history and future prospects of the business. The best product or service in the world may become a liability if the provider goes out of business.

Accordingly, for business due diligence, be sure to ask the following questions:

• How long has the vendor been in business? Is it a start-up company, a spin-off or an established company? Is it owned by another entity? If so, research the corporate parent.
• Does the vendor have offices in the United States or elsewhere?
• What, if any, third-party vendors (or subcontractors) does the vendor use?
• Does the vendor carry insurance for cyber liabilities? What other coverage does the vendor have? What are the amounts of the coverage and how is the coverage structured?
• Does the vendor have and regularly test its business continuity and disaster recovery plans?
• What is the turnover rate of the vendor’s employees? Does the vendor perform background checks of its employees and contractors?
• What is the reputation of the vendor and its products and services in the organization, community or nation? (Do not rely on what the vendor may claim or state.)

It is appropriate to ask questions such as these before making a significant investment of time, money and resources in the vendor's products and services. Some of this information may be available through open source records.

Technical due diligence

Assessing a vendor from a technological perspective includes evaluating how reliable and secure the vendor’s product or service is.

Consider asking the following questions when assessing a vendor's technical competence.

• Is the vendor's product or service on premises or based in the cloud? Who is responsible for support and maintenance?
• How will the product impact the agency's business, IT operations, administrative functions and workflow?
• Will the vendor support the product or service as long as the agency anticipates using it?
• If the vendor is a cloud service provider, is it certified by the Federal Risk and Authorization Management Program? Ask about other third-party certifications and check the most recent SOC 2 report from data center operators.
• Does the vendor meet applicable requirements of the National Institute of Standards and Technology, such as NIST Special Publication No. 800-53 Rev. 4, Security and Privacy Controls for Federal Information Systems and Organizations?
• Can the vendor provide the results or summary of the latest risk assessment?
• Was the vendor’s product or service developed in-house or by a third party? In terms of the development, were secure coding standards applied? Was threat modeling continuously done during the development phase? The security of the vendor's IT supply chain may be important to consider.
• Will the vendor have administrative access to your agency's data? If so, under what circumstances will the data be accessed?
• What is the vendor’s policy for notifying customers of security incidents and breaches? How does it address reports of operational or security bugs? Is there a good communication process in place?
• How does the vendor's offerings compare against its competitors in meeting your business and technical requirements?

The answers to these questions will help vet the vendor’s products and/or services. Proper vetting from a technical perspective can avoid headaches in the future for one’s organization and staff.

Legal Due Diligence

It is a myth that contracts consist of just boilerplate language. If there is a dispute or if a right needs to be exercised under the contract, the language agreed upon in the contract can be critical.

Accordingly, review the vendor's standard terms and conditions for the product or service.

• Does the contract meet the business, technical and legal (including compliance) requirements of your agency?
• Does the vendor meet applicable NIST standards and other compliance or legal requirements?
• Is the pricing structure clear? Are fees subject to change? Is there a cap in the increases from year to year?
• Are there any warranties for the vendor's product or service? Pay attention to the limitation of liability and indemnification language as well.
• When can an agency “walk away” from the contract? Under what circumstances may a contract be terminated for convenience, a potential breach or a dispute? Are the remedies provided by the contract acceptable?
• Does the vendor retain the data even after termination of the contract? How does an agency get its data back?
• If the vendor is required to destroy the data at the end of the contract, what assurances can be provided that the data has been securely destroyed?

Never sign a vendor’s contract without thoroughly reviewing it, being sure to clarity all the terms and conditions within a contract. Legal professionals can help with due diligence and ensuring that the contract is a good fit for the organization.

An ounce of prevention is worth a pound of cure. Appropriate due diligence, from a business, technical and legal perspective, is mandatory prior to buying IT products or services. Ensuring that the "what ifs" have been addressed in the contract will provide protection if the vendor fails to perform.