Posts

Vendor Risk Management Policy

What it is, why you need it, and how to use it.

You might be thinking something like:

“Meh! We don’t need another policy that nobody will read! Policies are a waste of time, especially a Vendor Risk Management Policy!”

I get it. People aren’t thrilled by policies. They’re not exciting. They’re not fun either. For some, policies can even be painful.

Policies get a bad rap. Not because they’re evil or anything, but because people rarely use them well. The fact is, information security policies play a very important role in supporting all information security efforts, and a vendor risk management policy plays a very important role in supporting our vendor risk management efforts.

I don’t like wasting people’s time, so I’ll get right to the point. Most policy problems are founded in the confusion about what a policy is, why they need one, and how they should be used. So, let’s address this as simply as possible. After all, complexity is the enemy of good information security (remember this always).

NOTE: In some organizations, vendor risk management and third-party information security risk management have slightly different meanings. Third-party information security risk management is part of a greater vendor risk management effort. For the purposes of this article, we’re using vendor risk management and third-party information security risk management synonymously.

What a Vendor Risk Management Policy is

The “what” for any policy are the rules. Think of this in terms of a game. A policy defines the rules for the game. A vendor risk management policy defines the rules for the vendor risk management game. Simple.

If you’ve never played the vendor risk management game before, this could be a difficult policy for you to define. If this is you, ask someone you trust for help. Here are two options for you right now:

  1. You can download our template. Change the rules to fit the game that you’re willing to play and make it yours.
  2. Contact SecurityStudio – The experts at SecurityStudio will make sure you get all the answers you need.

There are some typical structural things that should found in every policy, including this one. Policies should contain a purpose statement, note the audience for the policy, the policy status (draft, approved, adopted, etc.), version, date, the policy itself (the rules), references (to standards and/or other documentation), enforcement intentions, and version history.

Your game, your policy. Don’t expect someone else’s policy to fit as-is, and don’t include rules that you don’t intend to play by.

Why you need a Vendor Risk Management Policy

If the “what” for policy are the rules, the “why” for policy is communication. Policies are used to communicate the rules to others. You don’t need a policy if you don’t have anyone to communicate the rules to. Good news, right?

Before you rejoice, it’s very unlikely that you have no one else to communicate the rules to. There’s almost certainly someone else who needs (or wants) to know the rules.

Think about who needs to know the rules for your vendor risk management game. The list could include:

  • Anyone else within your organization that participates in vendor risk management activities.
  • Anyone who’s interested in your organization’s vendor risk management activities (examiners, regulators, partners, etc.)
  • Anyone who’s ultimately responsible for your organization’s vendor risk management activities, including executive management and the board of directors (if one exists).

The more people who need to know about your rules, the more important the policy becomes. In a small organization where there is a single person who does all the vendor risk management activities, there’s less importance. Not “no” importance, just less importance.

How to use a Vendor Risk Management Policy

Once you’ve written a policy, it’s time to figure out how to use it. Every policy, including this one, must be approved, communicated, adopted, and adjusted (or revised). This is a policy lifecycle that is well understood by most.

  • Draft – The policy is drafted (as v1 in new policies, as incremented version in subsequent cycles).
  • Approve – The policy must be approved by someone with authority (executive management, BoD, etc.).
  • Communicate – The policy must be communicated to all personnel who are affected by it.
  • Adopt – Gap analysis (or audit) coupled with plans and projects to ensure compliance.
  • Review/Revise – Periodic (and regular) review of policy, suggested edits move forward.

Policies are reference documents and should be written this way. Let’s go back to our game comparison.

When you sit down with friends to play a new board game, how many people read the rules? Just one, and this is the de-facto person who oversees the game. How many people should read your policies (rules)? Just the person (or group) who oversees the game. As the game is played, the rules are referenced whenever a question comes up. Same goes for policies.

That’s it. Simple. Define the rules for vendor risk management, communicate the rules, and manage the rules. Vendor risk management policy in a nutshell.

Having a policy in place is great, but also having a workflow that evaluates all third-party vendors and brings your weakest links to the surface is even better. Schedule a demo with us today to get your easy-to-use vendor risk management program.

s2core

Estimate your score or book free demo today

/by

Vendor Risk Management Best Practices

Vendor Risk Management best practices (VRM) conjures up all manner of interpretation. As a business leader, I’m concerned with all aspects….

  1. Are my vendors financially stable enough to fulfill our agreements?
  2. Are my vendors operationally capable of fulfilling our SLA’s and contractual requirements?
  3. Are my vendors doing enough to protect the data I’m sharing with them?

Numbers one and two are easy to measure and offer a mathematically sound position by which vendors may be held accountable. Number three scares me.

What are we to do in the face of daily news, very public and embarrassing news, of vendors’ indiscretions leading to the breach of sensitive information? More questions lead to more questions and on and on it goes.

As a company on the rise, including an ever-growing number of vendors and third-parties in the ecosystem, the need to do due diligence on data protection is ever increasing. Here’s the thing – it doesn’t have to be technical or out of reach if you’re not a technically-minded person. Understanding risk is the lynchpin to the process.

Defensible Position

Defensible position is the mantra of VRM. Say it with me – “Defensible Position.”

Start here – put ALL of your vendors through the same wringer. When doomsday (a breach) happens, the only defense you have is that a process was followed and that exceptions to that process were minimal and for a VERY good reason.

Example:

  • Jerry’s lawn service handles landscaping services for your business. Jerry and his team never set foot into your office, they just mow the lawn and keep the flowers alive. Still, Jerry should be able to withstand a brief questioning of the nature of your relationship be filed under the “low risk” designation and put into a queue to review in a year. If, by next year, Jerry is also providing maintenance services INSIDE your building, you should ask more questions because Jerry and his team may have physical access to information they didn’t have before. Make sense?

Jerry’s likely not a risk if he’s outside your doors. He’s a potential HUGE risk once he has access to the office. Keep an eye on that with a standard process to reevaluate all vendors like Jerry on (at least) an annual basis.

Assess

Once you’ve put your vendors through the “smell test” of risk (officially called ‘classification’) then move onto assessing whether or not they are doing the right things with their access to your information. There are a number of ways to do this, but in the interest of being in a DEFENSIBLE POSITION, make sure all vendors of a particular classification (high, medium, critical, etc.) get the same assessment.

Lawyers love words like “assume, thought, maybe, about, approximately, etc.” so eliminate that possibility. By measuring your vendors with the same ruler, you take subjectivity out of the equation. Starting to see the advantage, here?

  1. You cannot protect yourself from the breach. There, I said it. The skill and nature of the “bad guys” are such that total immunity is impossible. Accept that and move on to managing the risk of the situation. What is the likelihood of a breach? How bad would it be if you were breached? If you don’t have the math to lean on for answers to those questions, you’re VRM (and overall security strategy) is inadequate. Period.

Five years ago, achieving a well-measured VRM program was incredibly expensive and often reliant on specialized expertise that was in increasingly short supply. Times have changed and there are options out there that have real effectiveness, such as SecurityStudio , which automates the process and put you in a defensible position.

So, now you’re in a defensible position and at least feel good that you’re doing what’s expected and being responsible. But, there’s a greater responsibility…

2. Help your vendors practice better security. You’re in a position to help the organizations who wouldn’t naturally care about security. Put the basics in place to better protect themselves and you. VRM is a GREAT way to lead your suppliers to best practices while also protecting yourself in a more effective way. It costs you nothing and has (potentially) enormous benefits.

The soapbox if officially unattended. To recap…

  1. Get all of your vendors in a common process.
  2. Rank your vendors according to the same criteria.
  3. Assess your vendors’ security and get some math around their risk to you.
  4. Help your vendors get better – don’t just point out problems and wish them luck.

Please get in touch with me, John Harmon, if you have any questions. There’s a lot of uncertainty and lip-service out there trying to profit from your uncertainty. Lean on people who have the experience and the propensity to serve to help you with VRM, or any other security concerns you have. The good guys are within reach and ready to help.

For an easy-to-use automated workflow that evaluates all third-party vendors and brings your weakest links to the surface, schedule a demo with us today!

s2core

Estimate your score or book free demo today

/by

Top 5 Benefits of a Vendor Risk Management Program

Many companies are daunted by the task of building a vendor risk management (VRM) program that gathers all vendors in one place, classifies them, assesses the risky ones and determines if that risk should be remediated or terminated. However, the benefits of an automated VRM program easily outweigh the risks of not doing vendor risk management.

1. Reduced Costs and Time

When defining your VRM program, ensure you setup a centralized process. A centralized VRM program is one that is built and coordinated so that all information is easily accessible by members of your organization, not just those that are managing vendor relationships.

To be successful, your vendor risk management program must include members from a variety of groups, such as finance, legal, IT, procurement, accounting, purchasing and more. Each should have a role in helping to inventory and classify your vendors. In the long run, a centralized process will help to reduce costs and time involved in managing your VRM program.   

2. Reduced Risk

Once all vendors are in your VRM program and classified, you’ll begin to get a good snapshot of where the third-party risk lies in your organization. All vendors should be classified by low, medium or high risk, so the vendor risk manager in charge of your VRM program can start focusing on just the medium- and high-risk vendors.

Once your high-risk vendors are pinpointed, you can begin to reduce the risk they pose on your organization by requiring them to do a risk assessment. If this assessment results in unsatisfactory risk, you’ll have the choice of asking them to remediate their risky practices or eliminate them as a vendor.

3. Maintaining Compliance

It’s critical for businesses in regulated industries to remain complaint. As third-party breaches continue to rise, regulators are cracking down on organizations that are not properly managing their third-party vendors. Regulators classify vendors as an extension of the company’s ecosystem and, as such, both the company and the vendor could be penalized and/or fined in the event of a breach.

An adequate VRM program can simplify your compliance initiatives and can satisfy all industry regulation compliance requirements, thus putting your business in a good position when the regulators arrive.

4. Reporting

After the legendary third-party breach of Target, many CEOs and Boards of Directors began taking notice of vendor relationships. As a result, many are now asking for comprehensive reports on the state of risk of the organization as it relates to vendors. Without an adequate VRM program, pulling together this information can be nearly impossible.

Ensure that your VRM program has a robust reporting component so that you can easily pull an executive summary for your Board of Directors and a detailed vendor risk report for management.

5. Defensibility

Above all, being defensible in the event of an information security breach should be at the top of every CEO’s mind. No company will ever be 100-percent secure, so it’s more important to develop your company’s defensibility.

When a breach occurs at your company, regulators, lawyers, customers and more will come after you for retribution. Your company could be liable, even if the breach was caused by a third party, if you don’t have a VRM program in place that shows your due diligence. Your company’s due diligence is shown when you take the necessary steps to both track your vendors and determine their level of risk on your company.

If you want an easy-to-use automated workflow that evaluates all third-party vendors and brings your weakest links to the surface, schedule a demo with us today!

s2core

Estimate your score or book free demo today

/by

The Importance of Vendor Risk Management

A common theme for many organizations is that they don’t have time to do third-party information security risk management, or they don’t have the time to do it right. There are so many competing initiatives in an information security professional’s life, I get it. Do you have a case for not prioritizing third-party information security risk management, or not prioritizing it higher?

Let’s use logic to figure this out together.

NOTE: Notice I use the words “third-party information security risk management” in place of “vendor risk management”, this is because I think one is a little more accurate than the other. Third-party information security risk management usually fits within the scope of a larger vendor risk management program. For this article we’re going to focus on third-party information security risk management.

Three primary questions come to mind when thinking about the importance of third-party information security risk management:

  1. Is there a problem with NOT doing third-party information security risk management?
  2. If so, how big is the problem?
  3. What should you do about it?

Is there a problem?

So, you’ve got other priorities that prevent you from assessing and managing information security risks related to your vendor/third-party relationships. The fact that you have other priorities isn’t a problem, it’s reality. The fact that you may not be prioritizing third-party information security risk management, or that you may not be prioritizing high enough, could be a big problem.

Inherently, I know two things when it comes to third-party information security risk management:

  1. Nobody cares about the security of my information more than I do.
  2. Third-parties are the cause (directly or indirectly) of most known data breaches.

Nobody cares about the security of my information more than I do.

You know this is true, right? You spend thousands of hours, and many dollars trying to implement and manage good security controls within your organization. You’ve developed sound policies, worked tirelessly to make sure people are trained and aware of good security practices, you’ve spent thousands (maybe millions) on expensive technological controls like firewalls, intrusion prevention, data loss prevention, endpoint protection, and on and on.

You use third-parties to provide certain services to your organization. Maybe printing, maybe hosting, maybe IT support, who knows? Do you think the third-parties you use have spent the same amount of effort in protecting your information? Is thinking they’re protecting your information the same way you are, good enough? Play it out. Stay with me on the logic here.

We know that no matter what we do, we cannot possibly prevent all bad things from happening. We cannot eliminate risk, but risk elimination isn’t the goal anyway. Risk management is the goal and it’s the only thing that’s even remotely attainable.

Let’s say a vendor loses your information (this is more likely than you know, read the next section). Or, let’s say that an attacker gains access to your information through some sort of access that we’ve granted them. What happens next?

You conduct an investigation. Maybe there are lawyers involved. Maybe there’s customer data involved. Maybe you’re not sure. One thing is for certain, somebody isn’t going to happy. When the right (or wrong) somebody isn’t happy, somebody else needs to pay. The unhappy “somebody” might be a customer or group of customers, a government regulator, or the board of directors. The unhappy “somebody” might be all of the above.

The unhappy somebody is going to want answers. What answers do you think they’re going to want? They’ll want answers to questions like:

  • Did you know that your vendor was doing x, y, and z?
  • Did you ask how the vendor was protecting our information?
  • What sorts of questions did you ask the vendor about protection?

The quality of your answers will often dictate what and how much you’ll have to pay. No answers or bad answers will cost you more. Somebody almost always pays when something bad happens, the degree to which they pay, will largely be dependent on what answers they’ll have to defend themselves. This, in a nutshell, is defensibility.

Can ignorance be defensible, claiming you didn’t know any better? Short answer is “no”. The reason is outlined in the next section.

Third-parties are the cause (directly or indirectly) of most known data breaches.

Soha Third-Party Advisory Group conducted a study (Source: http://www.marketwired.com/press-release/soha-systems-survey-reveals-only-two-percent-it-experts-consider-third-party-secure-2125559.htm) last year that concluded the following; “third parties cause or are implicated in 63 percent of all data breaches.” You might be skeptical of this number, but the Soha Third-Party Advisory Group consists of some heavy-hitters in our industry, security and IT experts from Aberdeen Group; Akamai; Assurant, Inc.; BrightPoint Security; CKure Consulting; Hunt Business Intelligence, PwC; and Symantec. I didn’t write the study, but I believe that much of the findings represent the truth.


Soha Third-Party Advisory Group

Can you claim you didn’t know better? When you’re tasked with answering the inevitable questions that are coming your way after a breach, do you really think you can claim you didn’t know?

To compound our ignorance as a defense problem, are the following facts:

Third-party data breaches are on the rise, at least in the United States. A study by Opus concluded the “percentage of companies that faced a data breach because of a vendor or third party was higher at 61 percent, which is up 5 percent from last year and 12 percent from 2016”. (Source: https://www.pymnts.com/news/security-and-risk/2018/third-party-data-breaches-cybersecurity-risk/)

A study conducted by Kaspersky Lab concluded that the costliest data breaches are those that involved a third-party, especially for small to medium-sized businesses (SMBs). (Source:  https://mobile.itbusinessedge.com/blogs/data-security/breaches-from-third-parties-are-the-costliest.html)

Opus & Kaspersky Lab

Do you need more justification for re-prioritizing third-party information security risk management? Maybe you run a security program based on compliance, only doing what you’ve been told to do. This isn’t a good idea because information security is about risk management, not compliance, but let’s say it’s the way you do things anyway. Compliance is king. What if I told you that regulators and examiners are aware of the risks, and they read the same news we do. They are increasing the pressure around third-party information security risk management, and they’re losing patience with organizations that haven’t taken the risk seriously. It’s better to get ahead of this curve now.

Back to our original question; Is there a problem with NOT doing third-party information security risk management? My opinion, using the logic we’ve outlined together, is “yes”. There is definitely a problem with you NOT doing third-party information security risk management.

Are you convinced that you need a third-party information security risk management solution? If so, let’s figure out the right solution. If not, we’ll still be here to help when you become convinced. I promise.

How big of a problem is it?

Our next question was how big of a problem is it, meaning how pervasive is the third-party information security risk management problem in our industry? I promise to provide a short answer.

At a macro-level, relying on my unscientific observations from working with (up to 1,000) clients and discussions with other information security professionals, I would estimate that as many as 90% of the companies ranging in size from 20 – 30,000 employees do not have a third-party information security risk management program of any substance (or formality).

The problem is big in our industry. I would caution against using this as justification for not have your own (program); however. The herd mentality seems to be less and less defensible too.

Our last question: what you should do about it (meaning third-party information security risk management)?

What should you do about it?

For your own good, hopefully I’ve convinced you that not doing anything or deferring this issue until it becomes a higher priority, is not a good option. If not, like I stated previously, we will be here for you when you change your mind.

A well-designed third-party information security risk management program fits the following characteristics:

  1. It’s not disruptive to the business. After all, your business is in business to make money (and/or serve a mission). If information security gets in the way, you’ve got problems.
  2. It’s measurable in a way that you can show progress. Going from nothing, or next to nothing, to a fully implemented third-party information security risk management program is not feasible or encouraged. A solution that allows for gradual adoption over time is the right way to go.
  3. Doesn’t take shortcuts. The definition of information security accounts for administrative, physical, and technical controls. Only accounting for technical controls isn’t going to cut it, especially when we consider the fact that your most significant risk is people.
  4. Organized, standardized, and repeatable. These things make your program scalable and useable. The way to accomplish this is to automate all parts of the program that can be automated, without taking shortcuts.
  5. Intuitive, easy to use, and easy to understand. Third-party information security risk management shouldn’t be rocket science. A well-designed third-party information security risk management solution should be logical, so much so, that you don’t need vast amounts of experience and expertise to run it.

We specifically designed SecurityStudio to fit all the criteria necessary in a best-in-class third-party information security risk management platform. We did so by using more than a combined 100 years of information security experience, and at a reasonable price that doesn’t unnecessarily take away from your other competing information security priorities.

I invite you to speak to a SecurityStudio representative about how SecurityStudio will work for you. Schedule a demo too while you’re at it!

s2core

Estimate your score or book free demo today

/by

Deviating from Information Security Recommendations

Information security programs are around to protect the data of the businesses they are a part of. Understanding risk is an important part of that, but ultimately it’s the business’s job to make decisions on what types of risks they are willing to accept. It’s the information security program’s job to make informed recommendations about those risks. Sometimes, though,  those recommendations are ignored.

While it’s important to make decisions that are best for the business, deviating from security recommendations can pose challenges. It’s important that you maintain a simple, standardized, and defensible information security program (and vendor risk management specifically). Certain business decisions detract from that.

Simplify

 

We fully understand that a business’s first goal is to make money. That’s why businesses exist. Security programs are meant to create efficiencies that align with your business objectives to be a driving force for profit— not the other way around. However, if you chose to make decisions independent of our security teams’ recommendations, you can actually do the opposite.

Information security programs (and their vendor risk management initiatives in particular) can have a monumental impact on the efficiencies of an organization— especially as it pertains to employee time.

People in information security programs are often required to chase down vendors. You need to have an inventory of all of our vendors so that we know who poses threats to you. In order to do that, your security team will start at accounts payable, get a list of the current vendors your business works on, and then spend ludicrous amounts of time trying to understand the level of risk that vendor poses.

Because your information security professionals have a limited understanding of what each vendor does, they have to get an idea from the person who works with them most closely how their interactions may pose security threats. You now have two employees taking up their time to get this information figured out.

Once this is finally determined, the information security employee is going to send out a questionnaire or spreadsheet to the vendor in hopes that the person on the other end is the right contact, that they’ll fill it out correctly, and that they won’t have to be chased down every three weeks to see if it’s been completed yet.

Do you see how time-consuming this can be?

A vendor risk management tool automates many of these processes. It eliminates the chasing, the back-and-forth, and the manual entry your information security employees would otherwise go through. Because of this, their time can instead be used on the things that will make the most positive impact on your bottom line. The same is true with the non-security employees that have to assist.

You may decide that you don’t want to spend the money on an automated solution to help you smooth down these processes. Doing these things without systems, though, creates unnecessary complexities— and complexity is the enemy of security and business.

Standardize

 

Standards are crucial when it comes to information security. There are rules, guidelines, principles, and best practices that should help feed your information security decision-making.

Information Security Industry Standards

Certain industries have requirements and regulations they are asked to follow with regards to information security. If your organization fits their threshold, you likely have no choice but to comply. While these standards don’t necessarily provide the perfect example of what security is, they do provide good foundational rules to follow. Deviating from the rules of industry standards can have two effects.

This is actually an example of where deviating from rules and standards can be a good thing. As mentioned before, security standards often provide a good foundational base for your security programs, but they are often just that— a minimum requirement that helps you get started. Businesses can (and should) deviate from industry standards by adding to them. Adding measures on top of what the industry standards suggest you accomplish in your security program is an important step in bolstering your protections.

The opposite side of that coin is choosing to skip or ignore standards that are required by your industry regulations. Doing this can severely damage your business. Payment card industry (PCI) compliance is a good example of this. Many small businesses choose not to go through the steps of being PCI compliant because of the time, effort, and money that goes into complying. However, a breach that impacts your customers’ credit card information often creates irreprehensible financial and reputational losses that could end up forcing you to close your doors permanently.

When it comes to vendor risk management, the same concern applies. You can choose to deviate from acceptable industry norms, here too. Some organizations choose to change up the assessment questions that they ask their vendors to complete regarding their risk. Doing so may push you outside the compliance threshold within your industry standards and it also requires someone to justify the changes. Justification relies on subjectivity, rather than objectivity, and makes it significantly more challenging to explain if you needed to defend your decision.

Internal Standards

Standards are one way to get everyone within your business on the same page about things like acceptable risk levels, information security spending, incident response measures, and more. Implementing a set of policies and procedures that are standard across your organization, and across organizations similar to yours, ensures that you’re taking the appropriate measures to mitigate risks and protect your business.

Deviating from your internal standards proves that they aren’t the right standards. If you feel that you need to make decisions that go against the standards of your organization, they clearly aren’t working for your business. And you won’t be able to expect others to follow them if you aren’t either.

Your risk increases as you deviate from standards too. Take the S2SCORE for example. You can use risk assessment metrics like S2SCORE to set a risk threshold you want your organization and vendors to uphold. You might make a decision that everyone needs to be above a 650 in order to continue working with them. Sometimes, though, the business might feel the need to make a decision outside the standards set in place. You may work with an organization whose business is critical to the success of yours. Therefore, you may want to accept them as a vendor despite their S2SCORE being 550 instead. While it’s important you make these kinds of decisions if you feel they’re critical to the business, it’s also important to understand that this increases the likelihood your data is compromised.

Defend

 

Ultimately, creating standards and sticking to them is all about making your organization more defensible in the event that something does go awry and your data is compromised. Breaches do happen. Often. It’s impossible to prevent all breaches.

Deviating from standards makes your business less defensible when a breach happens.

If your business feels they need to make exceptions to rules for its benefit, that’s fine. If you make a system standard, you just have to defend the standard. Make sure you’re taking a logical and objective approach to all of your exceptions before implementing them. This will help you stay defensible (and help you ensure that your decisions aren’t going to have a negative impact on your security).

If you make decisions that deviate from standards, customize systems too much, etc., it becomes increasingly more difficult to explain your case to those who are asking. Unfortunately, a breach’s impact stretches beyond your boardroom. Customers, news outlets, lawyers, and more will be asking questions about how and why things happened the way they did— and what you plan to do about it.

Particularly on the legal side and the industry regulator side of this, you’re going to have to explain why this incident happened. If you make exceptions to rules, you have to defend the logic behind the exception. Why you didn’t go with your standard? This is important to think about as we consider making decisions that extend beyond the scope of industry and internal standards that have already been implemented.

Conclusion

While it’s important for businesses to take information security recommendations seriously, it’s also important to remember that information security programs are around to supplement the business’s objectives. For that reason, businesses should be allowed to make decisions outside the scope of industry and internal security regulations. If they do though, there can and will be consequences. Weighing those consequences can be challenging, and it can be difficult to defend the logic behind any deviations. At the end of the day, make if you’re going to make decisions outside the recommendations of information security standards, ensure they still help your business simplify, standardize, and defend.

 

s2core

Estimate your score or book free demo today

/by