Vendor Risk Management

Vendor Risk Management Services: Know Your Risk Before You Sign a Contract

When you rely on third-party suppliers, your data security and regulatory compliance are only as good as theirs. If you outsource any part of your operations, a vendor risk assessment and management program helps you obtain and maintain compliance. It also protects your profitability and brand reputation, and limits your liability.

You’ll rest assured when you work with Essendis advisory consultants because they:

Have experience managing the vendor risk process with Fortune 500 companies, bulge bracket banks and nationally ranked healthcare providers. They know the right questions to ask third-party suppliers.

Make sense of the different technology and service delivery processes from a variety of vendors.

Provide independent, practical and actionable evaluations to help your team understand and mitigate vendor-specific risks.

Can work with your vendors to craft a Plan of Action & Milestones (POA&M), Corrective Action Plan (CAP) or custom remediation plan. The plan asks the vendor for features or processes that align with your requirements.

Experience Backed By Industry Expertise

Big Four experience that includes the most advanced training on audit methodology and top-tier cybersecurity certifications: CISA, CISM, CISSP, CCSP, PCIP, HCISPP, CPA.

We’re abreast of the latest changes in the cybersecurity and legal environments through membership in the AICPA, the SANS Institute, the PCI Council, (ISC)² and ISACA.

Discuss what vendor risk management could look like for your organization.

Connect with an Expert

A Risk-Based Approach to Managing Suppliers

To assess a supplier’s security posture and operations, Essendis can conduct an initial vendor evaluation. For a deeper analysis, the supplier completes a detailed questionnaire of upwards of 1,000 questions. The answers provide critical insight into their adoption of key cybersecurity concepts, including:

Physical security of the facility.

Environmental security — natural or man-made environmental threats to the facility.

Data transfer and retention.

Secure system development lifecycle.

Data encryption.

System interconnections — how, if at all, does the system communicate with other systems.

System availability — processes for redundancy, backup, disaster recovery and more.

Administrative and user system access.

Flexible Solutions to Guide Your Vendor Risk Management Program

Choose from the following service offerings to evaluate and mitigate third-party risk across your supplier base:

Bronze

Individual assessments

A single vendor assessment, which is ideal for companies that occasionally work with new vendors.

SILVER

Assessment Bundles

Save when you invest in packages of 5, 10, 20 or more. Bundles are perfect for businesses that work with multiple new suppliers each year.

GOLD

Managed Vendor Risk

All vendor assessments are conducted under one monthly fee. This managed program is best for companies that require a large number of supplier assessments each cycle.

Building a Vendor Risk Assessment Process

What is a vendor risk assessment? In plain terms, it is a structured review of how a third-party supplier protects the data and systems you entrust to them. It also weighs what it would cost your business if those protections failed.

The process works in four stages. Know your vendor first: inventory every supplier and tier them by the data they touch and the access they hold. That way your effort follows real exposure rather than contract size.

Assess next, with questionnaires and supporting evidence mapped to the frameworks you already answer to. Then remediate, negotiating security terms into the contract and agreeing compensating controls where a supplier cannot meet a requirement outright.

Monitor last, and continuously. A vendor risk management plan built on annual snapshots misses the drift that happens between reviews. Build monitoring into the system rather than treating it as a once-a-year exercise. Regulated industries feel this most acutely. Healthcare vendor risk management has to evidence the process for every business associate that handles protected health information under HIPAA.

Logical access controls are one of the first things worth checking. They cover who can reach your data inside a supplier’s environment and how that access is granted, reviewed and revoked. Our cybersecurity advisory services team can help you stand up the process, or a virtual CISO can own it alongside your wider security roadmap.

How a risk assessment works:

Information Security Vendor Management Program

Information security vendor management is the ongoing work of controlling the cyber risk your suppliers bring. It starts with tiering vendor relationships by the data and access each one holds. Third-party vendors that store sensitive data or connect to your network get the deepest review.

Supplier reviews matter because cyber threats often enter through a vendor's access rather than your own network. A compromised vendor account can reach the same systems and data you granted it.

Due diligence happens before you sign. Send security questionnaires scaled to each tier, and ask for evidence that backs up the answers. Useful evidence includes System and Organization Controls (SOC) 2 reports and any certifications the vendor holds.

A security rating from an outside service shows a vendor’s internet-facing exposure. Ratings are one of several vendor cybersecurity solutions, and they only see a supplier from the outside. Treat a rating as one input alongside the questionnaire and evidence.

The contract turns your review into obligations. Require the vendor to notify you of security incidents that affect your data within an agreed time. Keep a right to assess, so you can review the vendor’s controls again after signing.

Third-party risk management continues after the contract is signed. Continuous monitoring tracks changes in each vendor’s security posture and across your wider supply chain. When a new cyber threat emerges, monitoring shows which vendors are exposed so you can follow up.

Automated vendor assessments keep the program running between reviews. They send reassessments on schedule and flag missing or changed answers for your team.

Vendor risk management (VRM) also produces evidence. A working VRM program gives auditors a current vendor inventory and a record of each assessment. It gives your board a clear view of supplier risk and the fixes still open.

Essendis can run this program for you through our vendor risk management services. If you also need a security leader, our virtual CISO services can own vendor risk within your wider security plan. For monitoring and response inside your own environment, see our managed cybersecurity services.

Vendor Risk Management for Healthcare

Under the Health Insurance Portability and Accountability Act (HIPAA), many healthcare vendors are business associates. A business associate is a vendor that handles protected health information (PHI) on your behalf. The business associate agreement is your contract control: it sets how the vendor protects PHI and reports breaches.

That is why healthcare vendor risk management starts with the vendors that touch PHI. List those vendors first, then confirm each one has signed an agreement and review its safeguards. For the technical controls on your own systems, read our guide to HIPAA vulnerability scanning requirements.