When your incident response partner becomes the threat actor, you're not dealing with a theoretical control gap. You're facing a failure mode that most audit programs don't test for: trusted intermediaries who know your negotiating position, understand your risk tolerance, and can sell that intelligence to the attackers holding your systems hostage.
Angelo Martino's 70-month federal prison sentence for assisting the Blackcat/AlphV ransomware gang illustrates this risk. He worked as a ransomware negotiator, then fed confidential client information to the criminals he was supposedly protecting victims from. Two colleagues in similar roles received four-year sentences for the same pattern of betrayal.
This checklist addresses the control environment around third-party negotiators, incident response vendors, and any external party with privileged access to your crisis management processes. It's built for internal auditors testing controls over vendor risk, privileged access, and incident response preparedness.
What This Checklist Covers
You're auditing the controls that prevent external parties from exploiting their trusted position during security incidents. The focus is on negotiators, incident response firms, forensic consultants, and crisis management vendors who gain access to sensitive information about your security posture, financial constraints, and decision-making processes.
This isn't a general vendor risk assessment. It's a targeted audit of controls specific to parties who operate during your most vulnerable moments.
Prerequisites
Before you start this audit, confirm you have:
- Current contracts for all incident response retainers and crisis management services
- Access logs for communication platforms used during past incidents (if any have occurred)
- Documentation of vendor access provisioning and deprovisioning procedures
- List of all personnel at vendor firms who have been granted access to your systems or communications
- Copies of background check requirements specified in vendor contracts
If you don't have these materials readily available, that's your first finding.
Checklist Items
1. Dual employment and conflict of interest screening
Verify that your vendor contracts explicitly prohibit employees from simultaneously working for or with ransomware groups, cryptocurrency exchanges that service criminal actors, or competing incident response firms without disclosure.
Review the last 12 months of vendor personnel assignments. Cross-reference names against public court records, sanction lists, and cybercrime-related legal actions.
Good looks like: A contractual clause requiring vendors to disclose any employee who has been charged with, convicted of, or is under investigation for cybercrime-related offenses, plus evidence that you actually checked.
2. Communication platform auditability
Confirm that all negotiations with threat actors occur on platforms that create immutable logs. DigitalMint instituted controls requiring cloud-based platforms that can be audited and logged after discovering their negotiators were compromised.
Test whether you can retrieve complete communication records from the last incident or tabletop exercise. Verify timestamps, participant lists, and message content are preserved.
Good looks like: Every message sent during negotiations exists in a tamper-evident log with participant attribution, accessible to your audit team without vendor assistance.
3. Segregation of negotiation oversight
Determine whether a single individual at the vendor firm has unchecked authority over client negotiations. At DigitalMint, one of the company's founders now personally oversees all negotiations as a control response.
Identify who at your organization receives real-time visibility into ongoing negotiations. If the answer is "nobody until we get the final report," you have a control gap.
Good looks like: Dual authorization for ransom payment decisions, with at least one person from your organization and one from the vendor's management (not the assigned negotiator) required to approve any payment above your predetermined threshold.
4. Background investigation depth
Pull the background check reports for the last three vendor personnel assigned to your account. Verify they include criminal record searches, employment verification, and financial stress indicators.
Compare the scope of these checks against what you require for your own employees with similar access levels. If vendor personnel get less scrutiny than your staff, justify why or close the gap.
Good looks like: Background checks that match or exceed your internal standards for privileged access, conducted within the last 12 months, with documented review by your security team.
5. Access termination procedures
Select three vendor personnel who no longer work on your account. Verify their access to your systems, communication platforms, and documentation repositories was revoked within 24 hours of their departure.
Test whether former vendor employees can still authenticate to any system you've granted access to.
Good looks like: Automated deprovisioning triggered by vendor notification, with manual verification completed within one business day and documented in your access review records.
6. Payment authorization controls
Trace the last three simulated or actual ransom payment decisions through your approval process. Verify that payment instructions came through authenticated channels and were validated against known-good contact information.
Check whether your payment process would detect if a negotiator provided fraudulent wallet addresses to divert funds.
Good looks like: Multi-party approval with out-of-band verification of cryptocurrency wallet addresses, plus a documented hold period allowing your CFO and CISO to review before funds move.
7. Vendor personnel monitoring
Review whether your contract allows you to request removal of specific vendor personnel from your account without cause. Test this by asking your vendor to confirm they would honor such a request.
Verify you maintain a list of all vendor personnel who have accessed your systems or participated in incident response activities in the last 24 months.
Good looks like: Contractual right to remove any vendor employee from your engagement immediately, plus quarterly attestation from the vendor listing all personnel with access to your account.
8. Insurance carrier coordination
If you have cyber insurance, confirm your carrier has approved your incident response vendor and that your vendor contract doesn't create conflicts with insurance requirements.
Verify your vendor won't negotiate payment terms that exceed your coverage limits without explicit authorization from both you and your insurer.
Good looks like: Written acknowledgment from your insurer that your vendor meets their panel requirements, plus a three-way communication protocol documented in your incident response plan.
Common Mistakes
Treating all vendor risk the same. Your incident response firm isn't like your office supplies vendor. They operate during crisis conditions when your normal oversight is weakest. Standard vendor risk assessments miss the unique threat model.
Assuming professional credentials equal trustworthiness. Martino had legitimate experience as a ransomware negotiator before he started selling client information. Professional background doesn't prevent insider threats.
Failing to test access revocation. Most organizations have a process for terminating vendor access. Few organizations test whether it actually works until they discover a former vendor employee still has active credentials.
Relying on vendor self-attestation. If your only evidence of background checks is the vendor's annual SOC 2 report, you're trusting them to police themselves on the exact control that failed in the Martino case.
Next Steps
Schedule a meeting with your procurement and legal teams to review vendor contracts for incident response services. Focus on the eight control areas above.
If you discover gaps, don't wait for the next contract renewal. Most vendors will agree to amendments that add audit rights, personnel screening requirements, and communication platform standards, particularly given the recent prosecutions.
Document your findings in your next audit report to the board. The question isn't whether your negotiator might betray you. The question is whether your controls would detect it before they maximize the ransom payment.
