Thanks, Edna, for once again saying 'out loud' what many of us are thinking! Vendors of all types, as well as third party service providers seem to run the gamut of extremely diligent, compliant and supportive of their customer's security (and Privacy) requirements, to laissez-faire, or worse, arrogant and dismissive when presented with a binding list of protective obligations.

I've turned vendors away who've refused to commit to our security controls requirements, wondering how, especially given the very public data breaches we keep hearing about and the legislative requirements we're responsible for complying with - how they even stay in business!

Who among us is signing up to partner with these vendors without demanding their due diligence, putting their companies at serious risk and enabling their bad behaviors? It's time we ALL demand more from those we entrust with our valuable assets. That collective pressure for better collaboration and stronger, compliant controls will help drive our vendors and providers to the level of strong security that they must provide to all of us, and that we require to manage our risk.

Cat