Vendor Risk Management II: How to Carry Out Vendor Risk Management

Steps To Incorporate Vendor Risk Management In Your Business

1. List all vendors your organization works with. Prioritize these vendors based on the importance of their service to your company, the kind of service they render, and how much of a security threat each poses to the organization. This allows you to coordinate your internal resources best and tackle the high and critical threats first.
2. Document the vendor selection process and criteria, available vendor details, and audit reports for every review. 
3. Ensure the vendors have a security framework that aligns with your organization.
4. With the help of your legal team, prepare a contract detailing the business relationship between your organization and the vendor.
5. Conduct a periodic review and audit of clauses included within the contract and ensure they are met. These reviews ensure that the vendor meets regulatory standards for the industry and that certain parts of the contracts that are outdated or unfavorable to the parties involved can be changed.
6. Collect fourth-party vendor details and assess your vendor's policies for its vendors. Don't just assess your vendor; also evaluate your vendor's vendors, as their activities could have a spiral effect on your company.
7. Document risks identified in the process and proposed mitigation plan. This way, certain risks will be avoided in the future.
8. Educate employees about the importance of the process and ensure a clear line of escalation for any red flags.

Risk Management Questions to Ask Your Vendors Before They Are Onboarded

• Is there a disaster recovery strategy in place? If yes, how often do you apply it? This will help you to know how prone they are to disaster and how capable they are in handling such situations.
• Do you have a security policy and skilled resources to manage security within your organization?
• How do you ensure your security guidelines are carried out throughout the organization?
• Do you have a cybersecurity policy, and have you used it to assess cybersecurity? Here, you can request the result of the assessment to ensure that they are being honest with you.
• Are there monitoring tools and software used within your organization for the network? Please share the tools.
• Do your employees have access to sensitive data in your possession, and are they allowed to access software without permission?
• What is your breach notification policy? Do you notify the customer whose data has been breached? Or do you inform all customers?
• Do you work with other vendors? Can you provide a list of these vendors? You can investigate these vendors to ascertain their credibility and legality.