Posted on Apr 16, 2021
Continuous monitoring of 3rd-party vendors has become increasingly important - no surprise here. So, what should you do when a vendor’s security rating isn’t up to your risk management standards? What if they are showing inadequate security controls or a lack of good documentation on their program? Despite the cries from your procurement or business unit teams, you’re not trying to “veto” the vendor. In fact, security ratings eliminate that friction with internal teams by providing an objective risk assessment; helping the business onboard their vendor faster, while achieving the risk controls you need. Your vendors and other third-parties in your ecosystem factor into your exposure.
How do you engage these partners to participate?
Consider the situation when you look up a vendor and find they have a low score - let’s call it a “D” in SecurityScorecard’s simple A-F security ratings structure. That vendor is over 7-times more likely to be breached than another vendor with a better rating. What action do you take? Start by verifying that this vendor remains appropriate to engage with. Then, reviewing the findings in their rating, determine whether their low scores are related to services they provide to your business. If these risks are important to you, then they should be important to the vendor, as well. Assuming they pass these verifications, then you want to invite that vendor to start participating in the Ratings process. Making it easy for them to join is important: so they can instantly connect to the Ratings platform, get their own security rating and start addressing high-priority issues. Should they need help, our Customer Success team can engage with them, helping them with their action plan to raise their security rating.
Another situation could be crafting an action plan requiring a low-rated vendor to improve their score as a metric to maintain their position on your supplier list. To secure your ongoing business, they are going to want to maintain compliance. But your procurement team can’t be expected to regularly check-in and assess the vendor’s progress. You want to be able to provide the vendor with clear, actionable details for them to regain compliance. And, a cadence of reports needs to be provided to your vendor managers so they see progress - including whether the mandated remediation is addressed on schedule or if the vendor has missed the deadline.
Whether in procurement or VRM, SecurityScorecard users are able to easily invite vendors to collaborate. If a supplier isn’t already using Ratings to address their own risk, get them started by having them participate in minimizing your exposure. It starts with an email message template within the Ratings platform. Easily personalize the message, or even co-brand it - which often helps facilitate their cooperation. Finally, if your motivation is to have the vendor achieve a specific rating, you can set score expectations for clear accountability.
In our recent success story, Truphone’s former CISO, Nuno Teodoro, explained: “we require our vendors [related to those services] to have a certain score to do business with us, and SecurityScorecard scores are a big part of the ongoing performance review meetings we have with those vendors.” His policy is demonstrative of what has been becoming more and more common throughout the supply chain. Risk mitigation is part of the trust and shared interest a good partner relationship is built on.
This capability is available now, so you can log in and take a look at the workflow right away. Include your partner ecosystem in your risk management initiatives. Getting them started is easy. Most importantly, it will improve your security posture, and theirs.
Vendor management is the process an organization utilizes to assess and manage a third- or fourth-party vendor. Learn how SecurityScorecard can help.
Performing cybersecurity risk assessments is a key part of any organization’s information security management program. Read our guide.
Templates and vendor evaluations are needed to level that playing field, in a time efficient and fair way, so that the best vendors are chosen.
Co-founder and CEO, Alex Yampolskiy, speaks about the importance of measuring and acting on key indicators of cybersecurity risk.
You can’t manage what you can’t measure. Check out our list of the top 20 cybersecurity KPIs to track in 2021.
No waiting, 100% Free
Get your free scorecard and learn how you stack up across 10 risk categories. Answer a few simple questions and we'll instantly send your score to your business email.