WEBVTT

1
00:00:00.000 --> 00:00:05.680
My IT provider handles that. It's a reasonable answer. You've hired people to look after the

2
00:00:05.680 --> 00:00:10.960
technology, and you expect them to do the work. But when a customer asks how a safeguard is

3
00:00:10.960 --> 00:00:17.440
implemented, can your business show what has actually been done? Welcome to CPCSC Bytes,

4
00:00:17.440 --> 00:00:22.160
the weekly few bits of info on the Canadian Program for Cyber Security Certification.

5
00:00:22.160 --> 00:00:27.680
I'm Hans Study, and today we're talking about IT provider accountability, useful evidence,

6
00:00:27.680 --> 00:00:30.560
and why a monthly invoice can't tell you the whole story.

7
00:00:38.000 --> 00:00:43.760
These days IT providers go by multiple names, from managed service providers, MSPs,

8
00:00:43.760 --> 00:00:46.640
to the finance director's nephew that is good with computers.

9
00:00:47.200 --> 00:00:52.720
A good service relationship starts with clear responsibilities. What does the provider manage?

10
00:00:52.720 --> 00:00:58.240
What does your team manage? Who approves access? Who disables an account when someone leaves?

11
00:00:58.240 --> 00:01:01.200
Who checks that an important security setting is still in place?

12
00:01:01.840 --> 00:01:07.760
If everybody assumes somebody else owns a task, that task can disappear between the contracts.

13
00:01:07.760 --> 00:01:12.400
I've worked with and even for managed service providers, and I've seen how much difference

14
00:01:12.400 --> 00:01:18.640
clear reporting makes. The useful conversation isn't just, are we secure? It's what are we

15
00:01:18.640 --> 00:01:24.560
doing, how does it work, and how do we know? Let's take a simple example. An employee leaves

16
00:01:24.560 --> 00:01:29.920
the company. Somebody tells the provider. The employee's access is removed. What shows

17
00:01:29.920 --> 00:01:35.200
that the process worked? Depending on the systems involved, it might be a completed service record,

18
00:01:35.200 --> 00:01:40.320
an account status, or a relevant system log. The evidence needs to support the claim you're

19
00:01:40.320 --> 00:01:45.520
making. A document saying that access will be removed describes the intended process.

20
00:01:45.520 --> 00:01:50.560
It doesn't, by itself, show what happened to that account. The same distinction applies to

21
00:01:50.560 --> 00:01:55.840
technical settings. If a provider says that remote access requires an additional sign-in factor,

22
00:01:55.840 --> 00:01:59.680
ask where that requirement is enforced and how they verify it.

23
00:01:59.680 --> 00:02:04.240
The answer should connect the promise to the actual configuration and the process for keeping

24
00:02:04.240 --> 00:02:09.600
it working. Ask for logs or reports. This is something they should be able to provide.

25
00:02:09.600 --> 00:02:14.400
These are practical examples. They aren't a universal list of evidence that every organization

26
00:02:14.400 --> 00:02:19.920
must collect in exactly the same way. CPCSC preparation needs to reflect the applicable

27
00:02:19.920 --> 00:02:25.200
requirements, your scope, and the services you actually use. Outsourcing the work doesn't

28
00:02:25.200 --> 00:02:30.400
remove the need to understand those boundaries. At the same time, a request for evidence should

29
00:02:30.400 --> 00:02:35.520
be specific and proportionate. Nobody benefits from collecting a mountain of screenshots that

30
00:02:35.520 --> 00:02:41.040
doesn't answer a useful question. Start with one safeguard. Identify who owns it.

31
00:02:41.040 --> 00:02:44.960
Agree on what would show that it is implemented. Decide where that information

32
00:02:44.960 --> 00:02:50.320
is kept and when it needs updating. Handle the evidence carefully. Reports can contain

33
00:02:50.320 --> 00:02:54.720
account names, system details, or other sensitive information. Share them through

34
00:02:54.720 --> 00:02:59.360
the appropriate process with the people who need them. Here's your action for this week.

35
00:02:59.360 --> 00:03:03.840
Book a short review with your provider. Choose one important responsibility and ask

36
00:03:03.840 --> 00:03:08.000
them to walk you through the implementation and the supporting record. Ask them to provide

37
00:03:08.000 --> 00:03:13.040
monthly reports if possible. A good provider should be more than happy to meet and discuss this.

38
00:03:13.040 --> 00:03:16.960
They should be almost happy to give you evidence they are doing their job right.

39
00:03:16.960 --> 00:03:22.080
If something is unclear, use that conversation to define the gap and agree on the next step.

40
00:03:22.080 --> 00:03:25.360
If your provider starts quoting contract terms and saying things like

41
00:03:25.360 --> 00:03:29.840
we don't allow third-party auditing, that would void our contract or incur penalties,

42
00:03:29.840 --> 00:03:33.760
or we don't provide that information to clients, it's proprietary information

43
00:03:33.760 --> 00:03:38.320
or would cost a premium. Find someone else to come take a look, yesterday.

44
00:03:38.320 --> 00:03:42.320
Honestly, if that is what is said, reach out to me directly and I'll take a look at things

45
00:03:42.320 --> 00:03:47.520
for you. The goal is a service relationship where responsibility, implementation, and evidence

46
00:03:47.520 --> 00:03:53.280
line up, not a game of smoke and mirrors. Smoke and mirrors won't fly for CPCSC or the

47
00:03:53.280 --> 00:03:58.160
auditor. It shouldn't fly with you. Thanks for joining me for CPCSC Bytes.

48
00:03:58.160 --> 00:04:02.960
Have comments, questions, or suggestions? Reach out to me on the web at hans.study or on

49
00:04:02.960 --> 00:04:08.000
socials at StudyByt3s. Remember, keep asking useful questions and make sure the answers

50
00:04:08.000 --> 00:04:13.120
connect to how your business actually operates. I'm Hans Study, and stay curious.