Take Action, Proceed with Caution
What is Vendor Risk Assessment?
A vendor risk assessment is an essential step in the onboarding process of any vendor. It identifies and analyzes the potential risks linked to the vendor’s operations and their impact on your organization. The types of Vendor Risks can vary from compliance, reputation, finances, operations, and strategy to cybersecurity.
Vendor risk assessment is performed to determine the probability of uncertain events, and then identify, measure, and prioritize them. A thorough vendor due diligence ensures a foundation for productive relationships by helping you mitigate potential risks.
When To Perform a Vendor Risk Assessment?
An organization must not engage in a third-party vendor contract unless thorough due diligence and assessment are complete. This should be followed with routine risk assessments throughout the vendor lifecycle to ensure the quality of deliverables and to avoid any future risks.
A Vendor Lifecycle includes:
How to Conduct a Vendor Risk Assessment and Audit?
Every business must have a customized vendor risk management strategy, tailored to the organization’s operations and standards. Some of the standard steps which can be molded for specific industries include:
- Establish your risk appetite by creating a risk matrix.
- Determine the risks that are most significant to your organization.
- Select a framework to help you assess and manage vendor risks.
- Create a vendor inventory.
- Classify vendors according to criticality.
- Conduct risk assessments on all vendors and implement controls as necessary to keep risks at acceptable levels.
- Monitoring vendor performance over time.
Define Thresholds for Acceptable Levels of Risk
A well-defined threshold for acceptable levels of risk is a pillar of effective Vendor Risk Management. It is necessary for both inherent and residual risks within the ecosystem.
Defining your risk threshold is the first step to creating a threat matrix or threat model. Each assessed risk is ranked in a threat matrix according to its severity (x-axis) and the likelihood of exploitation (y-axis).
Risk Matrix
A sample of a Risk Matrix
This risk matrix is then used to evaluate the resilience of specific security policies in a vendor’s security program.
Vendor Risk Management Checklist
Identifying a vendor’s level of risk and establishing a framework to make decisions that support the company’s goals can be accomplished by asking the right questions about critical areas, such as governance and security. Here are some areas from which you can create a customized vendor questionnaire or checklist:
REFERENCES
- Do they have relevant references and credentials?
- What is the evidence of financial solvency that can be provided, including recent financial statements?
PERFORMANCE
- What is their percentage of on-time delivery?
- What contract stipulations, including terms, renewal, notification requirements, and required service levels, can they meet?
- What are their client and internal communication protocols?
- What project management process documentation will be provided for review?
COMPLIANCE
- When can we review their liability insurance to ensure that it’s up to date?
- What is their ability for verifying necessary licensing and regulatory compliance, such as governmental security clearance, financial regulatory compliance, or HIPAA training?
- Can they provide criminal and background checks, including any history of lawsuits, or criminal convictions, to demonstrate a history of compliance?
DISASTER PREPAREDNESS
- What is their readiness strategy for business continuity in the event of a widespread outbreak of disease?
- What are their disaster recovery processes, policies, and procedures for recovery or technology infrastructure continuation after a human-made or natural emergency?
SECURITY PROCESSES
- Do they have incident security breach management practices in place?
- What is their organizational security process? Can we review any relevant documentation?
- Who is in charge, and who receives training in the handling and safeguarding of customer information and procedural breaches?
- What are the physical security procedures that define security for offices and data centers? How do they handle visitors, access to premises, and surveillance?
- What is the asset management process of operating, maintaining, upgrading, and disposing of digital assets or other valuables?
CYBERTHREAT GOVERNANCE AND ORGANIZATIONAL STRUCTURE
- Who is responsible for security and cybersecurity within the organization?
- Who is the chief information security officer or chief information officer?
- What can you tell us about any teams or committees that meet regularly on cybersecurity issues?
- What cybersecurity policies do you employ?
- Where do they outsource IT or IT security functions?
- When and how frequently do they train employees on your IT security policies? Do they automate assessments?
- Who on their senior executive team participates in cybersecurity exercises?
- What is their prioritization process to protect their critical assets?
- What standards do they use to protect client information?
- What has been their most significant cybersecurity incident and how do they recover from it?
SECURITY CONTROLS AND TECHNOLOGY
- Who is in charge and how do they use cyber vulnerability and cyber threat information?
- When and how do they perform inventory on authorized and unauthorized software and devices?
- What practices have they developed to secure configurations for hardware and software?
- What do they use to assess the security of the software that they develop and acquire?
- What processes do they use to monitor the security of their wireless networks?
- What are their data recovery capabilities?
- What automated tools do they use to continuously monitor for malware? What processes and tools do they use to reduce and control administrative privileges?
- What processes do they have in place to prevent sensitive data exfiltration?
- What are their cybersecurity incident plans and preparations?
- What processes do they have in place to respond to an incident? Do you regularly practice those processes?
- When do they conduct external and internal tests to identify vulnerabilities and attack vectors?
- What do they use to manage remote access to their corporate network?
- What are their removable media policies and controls?
- When and how do they monitor for unauthorized connections, devices, personnel, and software?
- What is the process they have in place to communicate security incidents affecting clients’ data?
SPC NXT helps organizations avoid the pitfalls of vendor complexity with assets worth $10 billion investigated under Forensic & Integrity practices. With expertise in GRC, it provides comprehensive security and privacy management solutions such as Vendor Risk Management, Privacy, and Due Diligence support.
Disclaimer*
The templates provided above by SPC NXT are for reference only. While we strive to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability, or availability with respect to the information, articles, templates, or related graphics contained on the website.