91ÖÆƬ³§

91ÖÆƬ³§ a Vendor Security Assessment Service

Use a risk-based approach to right-size your vendor security assessments.

Analyst Perspective

Streamlining vendor assessment efforts through risks.

With the increase in third-party attacks and their adverse impacts, many organizations are struggling with managing vendor security risks through traditional approaches. Too much due diligence discourages vendors from bidding for your business, exasperates internal clients, and strains resources of security teams. These challenges are further exacerbated by increased expectations from regulators to strengthen vendor security risk management.

The solution is to rethink supply chain security and take a risk-based approach that will satisfy all stakeholders.

Streamlining the vendor security assessment process through a risk-based approach will improve efficiency by identifying and treating risks based on the service risks and organization's risk tolerance levels, respectively. Furthermore, a process that fosters continuous improvement in the vendor security risk management program will enable monitoring and improvement based on appropriate and relevant metrics, which will help identify further enhancements to the assessment.

91ÖÆƬ³§ing an effective vendor security assessment service will contribute to the advancement of an organization's security risk management, which will integrate with the enterprise risk management program to drive innovation and provide visibility, which will in turn help to inform good decision-making across the organization.

Ahmad Jowhar
91ÖÆƬ³§ Analyst, Security & Privacy
91ÖÆƬ³§

Executive summary

Your Challenge

• Vendor security risk management is a growing concern for many organizations. We often trust our suppliers and business partners with our most sensitive data and processes.
• More and more regulations require vendor security risk management, and regulator expectations in this area are growing.
• Increased reliance on vendors makes it more difficult for organizations to manage and treat third-party risks.

Common Obstacles

• Too many security leaders start with a one-size-fits-all approach to vendor security assessments and end their engagement as soon as a vendor is selected.
• Security assessments that are too onerous will lead to vendors refusing to bid for your business, driving the business to bypass your assessment process.

Info-Tech's Approach

• Develop an end-to-end security risk management process that includes assessments, risk treatment through contracts and monitoring, and periodic reassessments.
• Base your vendor assessments on the actual risks to your organization to ensure that your vendors are committed to the process and you have the internal resources to fully evaluate assessment results.
• Understand your stakeholder needs and goals to foster support for vendor security risk management efforts.

Info-Tech Insight

Assessing vendor risk can be very time-consuming. Use risk to scope down your efforts, and augment your process with tools and AI to achieve maximum efficiency.

Common obstacles

Organizations are not ready to efficiently mitigate third-party risks.

The increasing incidence of third-party attacks has resulted in organizations placing emphasis on the management of their vendors, which includes security assessments to identify and mitigate the security risk to the business.

However, too many security leaders start with a one-size-fits-all approach to vendor security assessments and end their engagement as soon as a vendor is selected, which lacks the strategic approach of assessing vendors through a risk-based lens and continuously monitoring the process until the vendor is offboarded.

Security assessments that are too onerous will lead to vendors refusing to bid for your business, driving the business to bypass your assessment process.

A vendor security assessment methodology that lacks relevant questionnaires, service and vendor risk assessments, and applicable risk treatment plans will result in an inefficient vendor security risk management program that will be time-consuming and bring additional risk to the organization.

Info-Tech's methodology for building a vendor security assessment service

Insight summary

Invest your efforts in your riskiest vendors

Assessing vendor risk can be very time-consuming. Scope down your efforts by prioritizing the riskiest services, and augment your process with tools and AI to achieve maximum efficiency.

Engage all stakeholders to ensure efficiency and effectiveness

Maximize the efficiency and effectiveness of your vendor security assessment by leveraging existing processes and obtaining buy-in from stakeholders by integrating their needs into the process.

Right-size the process with a risk-based approach

Putting risk at the core of the process is the best way to achieve your vendor due diligence goals in the most resource-efficient manner possible.

Design an end-to-end process

A one-and-done process for vendor security can introduce risks that grow in the shadows without proper visibility, especially when business units contract a vendor for a low-risk service and then begin granting them riskier and riskier business arrangements without updating the original contract.

Not all vendors are the same

Taking a one-size-fits-all approach to vendor security risk management and treating all vendors the same way is the fastest way to fail.

Periodic reassessments are key

Proper vendor security risk assessments need to be part of a cyclical process that reassesses risk at regular intervals.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

Vendor Security Policy Template	A policy template mapped to various regulations and standards that outlines vendor security.
Vendor Security Process Template	A process template with a RACI matrix and process diagrams to depict the process for different contract phases.
Vendor Security Process Diagram	A process flowchart depicting the vendor security assessment process for different contract phases.
Vendor Security Requirements Template	A template containing security requirements that organizations can include within vendor contracts to mitigate identified security risks.

Key deliverables:

Service Risk Assessment Questionnaire
Vendor Security Questionnaire
Vendor Security Assessment Inventory

Blueprint benefits

This research aligns with Info-Tech's overall vendor management framework

Info-Tech offers various levels of support to best suit your needs

DIY Toolkit

"Our team has already made this critical project a priority, and we have the time and capability, but some guidance along the way would be helpful."

Guided Implementation

"Our team knows that we need to fix a process, but we need assistance to determine where to focus. Some check-ins along the way would help keep us on track."

Workshop

"We need to hit the ground running and get this project kicked off immediately. Our team has the ability to take this over once we get a framework and strategy in place."

Consulting

"Our team does not have the time or the knowledge to take this project on. We need assistance through the entirety of this project."

Diagnostics and consistent frameworks are used throughout all four options.

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is 6 to 12 calls over the course of 4 to 6 months.

Workshop overview

Contact your account representative for more information.
workshops@infotech.com 1-888-670-8889

Measure the value of this blueprint

An effective vendor security assessment service will have a measurable impact to your security program

Case study

Reducing risk, improving productivity, and achieving compliance in the vendor security assessment process

INDUSTRY: Higher Education
SOURCE: "Case Study," SecurityScorecard, 2024

Challenge

A US-based Tier 1 research institution was dealing with an increased cybersecurity attack surface due to the expanded collaborations of interdisciplinary research and peer review among universities. Being a small cybersecurity shop of dedicated staff, it lacked resources to assist in the development of an effective third-party risk management program.

Solution

SecurityScorecard collaborated with the university's cybersecurity operations team to streamline vendor security verification, saving time and increasing confidence in assessments. An automated vendor questionnaire allowed seamless cross-referencing of security posture claims with actual maturity, reducing manual checks and enabling the team to focus on critical tasks. This collaboration helped build a resilient vendor security management practice.

Results

The team reduced third-party data breach risks by adopting security reviews during procurement and working with stakeholders to meet business needs while strengthening security. It also ensured compliance with the Cybersecurity Maturity Model Certification (CMMC) 2.0, necessary for obtaining research funding. The solution addressed key CMMC 2.0 components, including subcontractor monitoring.

Phase 1

Define Governance and Process

This phase will walk you through the following activities:
1.1 Identify requirements.
1.2 Develop a vendor security policy.
1.3 Identify roles.
1.4 Define process.
1.5 Define treatment matrix.
Outcome:

• Defined governance structure for your vendor security assessment program

This phase involves the following participants:

• Information Security
• IT Risk
• Vendor Management
• Privacy & Compliance
• Business

91ÖÆƬ³§ a Vendor Security Assessment Service

1.1 Define requirements for vendor security assessments

60 minutes

Gather the required participants and use a whiteboard to brainstorm and capture requirements within the following categories.

1. Identify business requirements: Failure to identify business goals can result in a vendor assessment service that does not deliver required outcomes.
2. Identify customer experience: Most customers expect organizations to safeguard their data, including when it is being processed by fourth parties.
3. Identify compliance obligations: Regulators and legislators are becoming more interested in how regulated organizations manage risk, including vendor risk.

The following slides provide more information on this step.

Download the Information Security Requirements Gathering Tool

1.1.1 Identify business requirements

To determine business requirements, ask stakeholders leading questions. Some examples may include:

Info-Tech Insight

Security activities must support business objectives. An effective and efficient vendor security program will enable the business to leverage the supply chain in new and creative ways rather than acting as an obstacle to the achievement of goals.

1.1.2 Identify customer expectations

Today, most customers or clients expect some level of security to protect their data.

For many organizations, customer data privacy is arguably the largest driving factor for developing a mature IT security program.

• Repeat the same process you use to identify business requirements to elicit customer expectations as they relate to vendor security risk management.
• For organizations that deal primarily with consumers, these expectations are likely along the lines of "Protect customer data while it is being transmitted to and processed by vendors."
• Organizations whose customers are primarily institutional should review major contracts to identify customer security requirements.

Info-Tech Insight

When reviewing contracts with your business customers, look for requirements related to subcontractors or fourth parties. These will be relevant to how you manage the security of your vendors.

1.1.3 Identify compliance obligations

Regulators are increasingly focusing on how regulated organizations manage vendor risk. Identify compliance obligations by consulting with your Legal, Privacy, and Compliance teams and extracting relevant security requirements.

Examples include:

You may also ask stakeholders if they are aware of increasing regulator interest in this area or if you have been subject to external audits that are testing controls related to vendor security.