October is Cybersecurity Awareness Month. To help support cybersecurity awareness, we’re going back to basics. A refresher of sorts, to remind you of the fundamentals, the MVP (minimally viable product) you need to ward off hackers. All too often, we’re seeing headline after headline of businesses, from Enterprise-level to SMBs, who failed to do the very basic steps in a third-party risk management program. And it’s costing them more than just money and lost data. Reputations are on the line.
- Define Vendor Risk Tolerances
Only you know the level of risk your business is comfortable with, so it makes sense that you’ll need to define your vendor risk tolerances as the first step in the process (avoid a platform that tries to define them for you). This involves categorizing your vendors into various “buckets,” such as high, medium, or low. Each level comes with its own set of criteria and identifies a level of risk threshold.
To determine your levels, first consider any compliance frameworks you must uphold, such as HECVAT, HIPAA, FINRA, and others. Then categorize the vendor by the level of risk they pose to your company. Obviously, the vendor who delivers coffee and snacks and has no access to your data will be classified as low-risk. Other vendors, who may have access to your networks or financial or client data, will be classified as high risk.
- Find a Vendor Risk Assessment Platform that Fits Your Needs
Many businesses, even some Enterprise-level companies, are still using manual spreadsheets to complete vendor assessments. This can slow the process to a crawl and also invite human error. Before automated platforms hit the market, this was the only alternative. But now technology has taken TPRM programs leaps ahead.
If you’ve never experienced all that an automated Vendor Risk Assessment platform offers, take a demo of one and see what you’re missing. Some make it easy for you to seamlessly transition from a manual process to an automated one and will allow you to upload your own vendor questionnaires and risk tolerance levels into the platform. Once this step is complete, you can sit back and let technology do the work. An automated platform can increase efficiency in your program by notifying vendors when an assessment is due, send reminder emails, classify vendors according to your risk tolerances based on their answers to your assessment questions, and so much more.
- Identify and Prioritize your High-Risk Vendors
After all vendors are assessed, go back to step one and use the vendor risk tolerances to identify and prioritize your high-risk vendors. Again, if you select the right vendor assessment platform, this becomes an automated process, not a manual one.
Focus the majority of your efforts on your high-risk vendors. These are where your company is most vulnerable. Carefully evaluate their assessment questionnaire and ask for risk remediation where they fall below your risk tolerances. Or, if their risk tolerances are too great, find a new vendor.
- Don’t Stop There! Continuous Monitoring is Essential
Many companies think that once all of their vendors are assessed and categorized, their due diligence is complete until next year. This is where many companies fall prey to hackers. A vendor risk assessment is only a snapshot in time. Tomorrow, a medium-risk vendor that met your risk tolerances for security today might hire a new vendor (a fourth-party vendor to you), and that vendor could create new risks for your business.
Continuous monitoring is one way to alleviate this issue. It runs 24/7 in the background and notifies you when any of your attack surfaces are compromised. If that medium-risk vendor hires a new vendor that puts your business at risk, you’ll be notified immediately, not next year when you perform the next vendor assessment.
- Build a Business Continuity Plan
When your company gets hacked (note we say “when,” not “if.” No business is 100-percent safe from hackers), a continuity plan is essential for acting quickly to reduce the amount of harm that can be done. It details how you’ll respond in the event of a breach. Include such things as who the key team members are and what steps they must take to get your systems secured. Identify timelines for each step so that your team acts swiftly to contain any further damage that could be done.
- Reduce Your Level of Vulnerability
The right Third-Party Risk Management (TPRM) program can dramatically reduce your level of vulnerability, which is key to safeguarding your data and assets. ProcessBolt offers a complete platform: vendor assessments and continuous monitoring in one. Learn more at ProcessBolt.com or fill out the below form to schedule a quick, 15-minute demo and receive ThreatScape free for 30 days.
