5.3a third party risk assessment

Third-party risk assessment

Evaluating how a vendor protects shared company data, since working with vendors always involves sharing some level of organizational data.

Risk assessment in contracts

Risk assessment requirements and expectations should be written directly into vendor contracts, including penalties for breach of agreement.

Penetration testing (third-party context, reinforced)

Can be mandated by contract between an organization and a vendor, sometimes performed by an independent third-party pen testing firm serving both sides.

Rules of engagement (reinforced)

Scope, timing, IP ranges, emergency contacts, sensitive data handling, in/out-of-scope systems; same concept from earlier, now applied to vendor relationships.

Right-to-audit clause

A formal contract provision establishing that regular security audits of the vendor will occur, and setting parameters for how those audits are conducted.

Independent/third-party audits

Often performed by an outside party rather than either the organization or the vendor directly, to ensure objectivity.

Compliance-driven audits

Some audits are required based on the type of data stored, tied to regulatory compliance requirements.

Audit focus areas (vendor relationship)

Access management, offboarding processes, password security and storage, VPN access controls.

Supply chain

The entire process from raw materials to final product or service delivery, with security concerns at every step.

Supply chain analysis

Evaluating vendor-to-customer product/service flow, cross-organization coordination, technical security handling, and documenting business process changes.

SolarWinds attack (2020)

Real-world supply chain attack: attackers breached SolarWinds, embedded malware in a software update, and that update was signed with a valid SolarWinds digital signature and distributed to about 18,000 of 300,000 potential customers.

SolarWinds lesson

A vendor's own security controls (like code signing) can be technically flawless and still fail if the vendor itself is compromised at the source.

Independent/outside assessment

Bringing in an external party for a fresh perspective, since internal teams are limited to their own organization's viewpoint.

Due diligence

Investigating and verifying a potential vendor's claims (revenue, customer base, background) before entering a business relationship.

Conflict of interest (vendor)

A situation compromising judgment on either side, e.g. a vendor also serving your biggest competitor, employing a relative of your executive, or offering gifts tied to contract signing.

Ongoing vendor monitoring

Continuous relationship monitoring after contract signing: financial health checks, IT security reviews, news and social media monitoring.

Due diligence vs ongoing monitoring

Due diligence happens before signing a contract. Ongoing monitoring happens after, throughout the life of the relationship.

Quantitative and qualitative vendor monitoring

Combining both measurement types for a fuller picture of vendor risk over time.

Vendor questionnaire

A tool sent to vendors to gather information about their due diligence process, disaster recovery plans, data storage methods, and protections; feeds into ongoing risk analysis.