Vendor Risk Management: Ten Frequently Asked Questions

Email     |     Share  
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12
Next Next

Questionnaires

Should I do questionnaires? If so, when should I send them out, and how often?

A questionnaire is a great way to get a sense of the security measures and protocols that your vendor has in place. These surveys can vary in length dramatically — some could be 10 questions, a hundred questions, and others several hundred. The length of the questionnaire and depth of the questions will have a lot to do with the risk that the vendor poses. Pretend for a moment that you are Coca-Cola, and one of your vendors has the secret formula for Diet Coke. You're probably going to want to ask that vendor a ton of questions to ensure that the formula is secure.

The optimal time to send out a questionnaire is when you're on-boarding a vendor. Frequency after that is variable. Some companies opt to send shorter questionnaires annually (in an attempt to follow up), while others simply ask that vendors send any important changes to their IT department. Either way, you'll want to be updated if your vendor makes a large change (for example, if they stopped doing an important function in-house and decided to outsource to a third party).

As cyber threats become more sophisticated and complex, businesses need not only to ensure they are secure, but that their vital partners, suppliers and vendors are protecting themselves as well. According to the 2015 Verizon DBIR, 70 percent of observed cyber attacks involved a secondary victim. To avoid being blindsided, organizations are beginning to monitor the security of their third parties to reduce the likelihood of a data breach.

Gartner estimates that around 10 percent of companies have formalized IT risk management programs, but that the figure will grow to 40 percent by 2018. If you're just beginning to implement a vendor risk management (VRM) program, BitSight Technologies has identified 10 frequently asked questions to help you get started.

 

Related Topics : Unisys, Stimulus Package, Security Breaches, Symantec, Electronic Surveillance

 
More Slideshows

Security117-190x128.jpg 5 Steps to Protect Executives from a Whale-Phishing Attack

Whaling is a type of spearphishing targeting "big fish" in an organization with access to sensitive, highly-valuable information. ...  More >>

Security116-190x128.jpg 5 Common Failures Companies Make Regarding Data Breaches

Five common failures companies make when preparing for, and responding to, a data breach, as well as guidance for companies on how they can tackle these issues. ...  More >>

Security115-290x195 Data-Centric Approach Starves Data-Hungry Cybercriminals

Incorporating security capabilities such as encryption, better control and management and a data security framework will help alleviate the burden breaches place on the organization and people's lives. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.