Chapter 6 of 14 · Weeks 4–10
Vendors and the Inherited Mess
- What do I do with all the tools and contracts I inherited?
- Which suppliers could actually hurt us?
- How do I deal with vendors who want a meeting with the new CISO?
You inherit tools you did not choose, contracts you did not sign and suppliers you have never heard of. Some are excellent. Some are paid for and switched off. A few hold more of your company's data than your own systems do.
Sort the tools first
Make a simple list of every security tool: what it is for, who runs it, when it renews and whether anyone looks at its output. You will find overlap and you will find tools nobody uses. Do not cancel anything in the first month. Find out why it was bought first. Sometimes the reason is a contract or an audit you have not seen yet.
| Question | Why it matters |
|---|---|
| Who looks at its alerts, and how often? | A tool nobody watches is a cost, not a control. |
| When does it renew, and what is the notice period? | This sets when you can actually change it. |
| What would break if we turned it off? | Finds the hidden dependencies. |
| Who chose it? | Tells you who to talk to before you change it. |
Then find the suppliers that matter
Not every supplier is a security risk worth your time. Focus on the few that hold sensitive data, have access into your network, or would stop your business if they went down. A payroll provider, a cloud host, a managed IT firm with admin rights. Those are the ones you need a plan for.
- Ask finance for a list of suppliers by spend, and IT for a list by access. The overlap is your shortlist.
- For each one, know who your contact is when something goes wrong and what the contract says about telling you.
- Decide what you would do in the first day if they announced a breach.
The question you might not ask out loud
Do I have to take every vendor meeting?
No. A new CISO gets a lot of requests. A polite holding answer is fine: you are still learning the environment and will reach out when you have a defined need. Your time in the first months is better spent inside the company.
When you do decide to change something, change one thing at a time and tell the people who rely on it first. Replacing three tools in one quarter while learning a new company is how coverage quietly drops. Keep a short note of each decision and why you made it, so your successor does not have to rediscover it.
Rule of thumb:Rule of thumb: the supplier you worry about least is often the one with admin rights everywhere.