Within a busy organization, vendor risk management (VRM) can feel like an ideal concept, but can also seem far out of reach. Armed with a vendor risk management checklist and VRM software, like SecurityStudio, and establishing a vendor risk management program is well within grasp and can take less time, energy, and resources than expected. The first step to creating a VRM program is to develop a plan.
1. Develop a Plan
The first step in creating a VRM program is to create a plan. Simple enough, especially with a VRM software program like SecurityStudio. The great thing about using a program like SecurityStudio is that the vendor risk management workflow is already built in along with most communication. Everything is centrally located in the program, and vendors move from one phase to the next with everything in plain view. Most quality VRM programs include a classification phase, and then vendors are typically assessed followed by a treatment plan. Then there’s steps to repeat the process. With a plan like this the risk manager (administrator) will need to surround themselves with a quality team to execute the plan.
2. Assemble your Team
As with any vendor risk management program, the risk manager will want a group of professionals to help with inventorying vendors and classifying them. Talking to your team members and making sure that everyone is onboard will help with participation, and most importantly that they are given context as to how important information security and this particular vendor risk management checklist are to the organization. Team members can lose focus as to how important their role is partly due to the tedious nature of tracking down information. Putting a date on task also helps with motivating people with completing them.
3. Determine a Timeline
Putting a timeline on tasks for both the team members and vendors helps with moving the process along. If there’s not a timeline, then it’s easy for the vendor risk management program to be put to the side. Software programs, such as SecurityStudio, have built-in timelines, but the due dates and timelines can be customized if needed.
4. Inventory of Vendors
Taking inventory of the organization’s vendors is a key step in becoming defensible. Whether the organization is using a software program or a spreadsheet, there needs to be a list of vendors that can pose a possible risk in order to be defensible. This would seem like common sense, but in a lot of situations where organizations don’t utilize a vendor risk management software program, there are incomplete, inaccurate, or outdated spreadsheets floating around in employees’ inboxes. This alone could make a case for software program like SecurityStudio, where all vendors are located in one centralized location.
5. Designating a Relationship Owner
The security analyst, risk manager, administrator of the program, orwhoever is assigned these responsibilities (usually the same person) is notnecessarily the right person who would have access to contact information orwould have direct vendor information to accurately answer classificationquestions. Generally, the person whoworks directly with the vendor will be able to answer the questions mostaccurately. Of course, this can varybetween organizations.
6. Categorizing/Classifying Vendors
Classifying and Categorizing vendors is arguably the most important stageof any VRM program. VRM programs will measurethe risk of each vendor, and with software programs like SecurityStudio, this isdone efficiently and objectively. Thedecisions made at this stage will set the tone and precedence for all futurestages. In short, if you’re going to getone stage right, this is the one. Anassessment is sent based on this classification.
7. Assess your Vendors
After the classification stage, an assessment is sent based on theresults. This is especially true forvendor software programs like SecurityStudio. Assessments vary in length and scope based on classification, but it’sbest practice to have binary answers to assessment questions of either true,false, or N/A. If a vendor does have aconditional answer they will be able to explain the answer in another stage(usually during remediation). Havingbinary answers to assessments will create a stronger, more objective,assessment.
8. Establish your Threshold
As vendors start completing assessments, it becomes time to establishbest practices if the organization hasn’t already done so. For whatever method your organization choosesto assess vendors, there should be a minimum threshold as to how much risk theorganization wants to take on. InSecurityStudio, where the scoring is based on a scale similar to a credit score,the program has a recommended threshold, but organizations are able to settheir own threshold based on objective results. Whichever method is chosen, it’s best practice to apply the samestandards for all vendors or vendors within a set industry.
9. Choosing a Treatment Plan
Once the assessment results come back, then it’s up to the organizationto determine what to do with the results. At times it’s a matter of just approving the results, but if the resultsare not as favorable as expected, then an organization should have a plan inplace. This is another sample of asituation where best practices should be established. If a vendor is far toorisky to work with, or if the organization wants to give the vendor a chance toimprove their results, there should be clear plan. In programs, such as SecurityStudio, it’srelatively easy to look back on assessment results, and then choose a planbased on them.
10. Objectively Repeat the Process
Vendorrisk management is a never-ending process, and the VRM program needs to berepeatable in order to be effective at all. Business relationships change and morph over time, so it would only makesense that the VRM program should adjust to these changes. Not only would business relationships changeover time, but VRM practices will update with time. Updating the VRM program as new threatspresent themselves is just as important. With programs like SecurityStudio, the changes in security practices and updateswill be automatic and seamless.
This is what happened in the infamous case of Target Data Breach in 2013 and the vendor risk management checklist is something that might have prevented it.
If you want an easy-to-use automated workflow that evaluates all third-party vendors and brings your weakest links to the surface, schedule a demo with us today!
Estimate your score or book free demo today
Estimator | Get a Demo
