Vendor risk management (VRM) continues to be a strategic initiative for organizations that engage with more third-party vendors every year.
Outsourcing provides the opportunity for greater agility, exceptional customer experiences, and profitable growth. But cloud-based services, the Internet of Things (IoT), and the globally extended digital supply chain increase cybersecurity risks nearly as much as they open new doors for business operation.
According to the 2022 Verizon Data Breach Investigations Report, 62% of system intrusions came through an organization’s partner. This has made it critical to create and maintain formal programs for vendor risk management in order to avoid security incidents through external contractors.
In this blog, we offer a practical approach to vendor risk assessments with seven questions you can use to measure their inherent risk.
Understanding the Risk
Organizations work with dozens or hundreds of vendors that have access to sensitive data about technology, finances, inventory, shipping, licensing, media and advertising, recruiting, payroll, sales partners and distributors, among other things.
These technologies need to be secured and properly evaluated before fully entering the process and data ecosystem of an organization. Vendor risk assessments are the most essential method to evaluate their security posture, comprising sets of questions about their security controls, compliance with industry regulations, policies, procedures, and other contributing factors. With this information, companies are able to determine if the service provided outweighs the risks of working with a third party vendor.
Vendor risk assessments should be conducted both before and after engaging with a third party. It’s only natural that business relationships evolve as time goes by. There can be changes in scope, goals, strategy, and staff over the course of a relationship with a third-party. Or even a global pandemic, forcing companies to work remotely and expanding the risk surfaces across the globe.
This means that risk assessments are not over after the initial due diligence and onboarding process. In fact, organizations need to implement continuous monitoring strategies to detect compliance and risk issues in real time, as opposed to point-in-time assessments.
If you need a place to start, this cybersecurity risk assessment template can help.
7 Questions to Ask in Your Next Vendor Risk Assessment
The following questions are a great starting point that will allow your company to make an informed decision when assessing a third-party vendor:
-
Does the third-party vendor regularly check user privileges, and are these based on the principle of least privilege?
-
Does the third-party vendor have an updated information security program in place, with documented policies and procedures?
-
Are their employees trained on basic security best practices to deflect social engineering attacks, avoid phishing and scams?
-
What is their notification process when your data is shared with other parties or subcontractors?
-
Do they employ mechanisms to control access to areas containing sensitive information assets?
-
Do they have an incident response plan?
-
Are they willing to enact cybersecurity requirements through a formal agreement?
Integrating Questionnaires Into Your Vendor Risk Management Program
While many organizations send these types of questions manually via emails and spreadsheets, the most efficient way to do it is by building a scalable risk assessment workflow in a dedicated vendor risk management tool. This will allow your team to keep up with an ever-growing vendor base.
In addition, organizations typically complemente their risk assessments with standard questionnaires such as SIG Core and Lite, Cloud Security Alliance CAIQ, or CIS Controls; certifications like SOC reports, ISO 27001, or HiTrust; attestations such as penetration tests, application scans, or insurance documentation; or industry-specific standards such as HIPAA or NERC CIP.
Download Free Guide: Building a Vendor Risk Management Program From Scratch
Vendor risk management is not as resource-intensive as some companies may think, as there are tools and new approaches to simplify the process. Our Bitsight VRM platform leverages the work of industry peers who have already assessed common third parties, automating data gathering and communication between enterprises and vendors for a streamlined, automated outcome.
No industry is exempt from the attention of cybersecurity risks. As the threat landscape constantly evolves, so does third-party risk management, with networks becoming larger and more complex. The time to evolve your vendor risk management approach is now.