Home | Classes | Cybersecurity and Your ITS Provider

Cybersecurity and Your ITS Provider

The RFP process allows transit agencies to dictate information security expectations to their potential technology vendors. Yet, it is a process that is often used with varying degrees of success. Some RFP specifications provide little to no mention of cybersecurity, some specifications contain boilerplate language that often does not apply to the system being procured. Further, some specifications over-prescribe security requirements, resulting in costly and time-consuming project development and deployment schedules. This presentation will cover how to approach and evaluate the cybersecurity hygiene of your ITS provider. The main takeaways from the presentation will include:

Does your vendor follow a well-established cybersecurity framework?
What are your vendor’s information security policies? This includes what to look for in their Incident Response, Incident Notification, and Quality Management policies. Do these policies cover Corporate as well as Technology Development and Deployment arms of the organization?
Does your vendor’s product development lifecycle incorporate security best practices? For example, training, threat modeling, and vulnerability scanning.
Does your vendor’s operations group follow best practices? For example, access control policy and system hardening.
Does your vendor hold a third-party information security attestation or certification?
What information security requirements should be put in an RFP?
As the customer, what am I responsible for doing with a system that I just procured?

Christos Karanicolas, Senior VP, Engineering, Clever Devices

Clever Devices uses cookies on our website to, among other things, fulfill user requests, provide enhanced functionality for our users, and enhance web content. If you continue to use this site, you agree that we can place these types of cookies on your device. For more information, please review our Privacy Policy.