Request a quote
Who Checks the Network Your Provider Runs?

Who Checks the Network Your Provider Runs?

·

by

dtrainum
in

Briefing

An assessment is useful only when the reviewer has no stake in the result. When the same firm installs, operates and then reviews a network, every finding is a finding against itself. That is a conflict of interest even for honest people.

Banking guidance states it directly. The FFIEC IT Examination Handbook warns that conflicts can arise when an outsourced audit provider also serves in an IT or consulting role. The interagency policy statement on internal audit outsourcing describes the concern of a firm appearing to audit, or actually auditing, its own work. In healthcare, HHS says the Security Rule evaluation may be done internally or externally, and that HHS does not endorse or recognize private certifications of Security Rule compliance.

Telecom has long separated the two: a new circuit is accepted against the carrier's test results, not only the installer's word. Managed IT should work the same way.

What to do

  1. Separate the roles. The firm that runs your network, phones and endpoints should not be the firm that assesses them.
  2. Ask your operator to keep evidence ready: configuration records, patch history, access reviews and incident tickets, mapped to the framework you answer to.
  3. Choose the assessor yourself and have findings delivered to you, not routed through the operator.
  4. Treat any vendor "certification" of HIPAA compliance as marketing. HHS does not recognize it.

How to verify

  • Read your contracts. If one firm both operates and assesses the same environment, fix that before the next review.
  • Ask the operator for the evidence package an assessor would request. It should exist before the assessment is scheduled.
  • Confirm the last assessment report was addressed to your leadership, not to your provider.

Sources

Questions about your phones, network or IT? Contact Texwan.