Make Managing Third Parties and Vendors More Efficient
December 27, 2019
20 min read
The last article touched on third-party risk management and how it integrates into a company’s overall security program.
This time, we’re talking about automation and how it can help you make the steps of your third-party risk management processes more efficient.
Automating Identification
The identification of third parties is one of the most important steps in your third-party risk management process.
If you don’t know about the third parties that are associated with your environment, you won’t know that you have to measure or assess risks they present to your company.
Automating the identification step can be difficult, especially since many organizations handle this manually through contracts or use an external procurement system that can’t be directly controlled by the security team.
If the identification step is going to be automated through a use of a solution or technology, the security team should receive a notification when:
- A new third party is added. This should include the nature of the relationship, the primary contact, and any security requirements that are described within the contract.
- A third-party relationship or any details to that relationship change, such as updated security requirements or a new point of contact.
- A third-party relationship is terminated.
Automating this step will make it easier for the security team to track current third-party relationships and identify the depth of the assessments each company should receive.
Automating Categorization
Automation during the categorization phase is important to group third parties together based on the risk that they might present to your organization.
There are several opportunities to automate this step of the process, all of which depend on the categories that your organization uses.
One of the most common categories organizations use is through level of access or types of data managed. This information will affect what impact these third parties have on your environment, and there are existing GRC (governance, risk, and compliance) solutions that can automate the collection of this information through questionnaires or pre-assessments that are sent before signing a contract with a third party.
Your organization can also create categories based on publicly available information. These solutions typically scour the internet for information on a company, including any previous breaches, DNS problems, information available on the dark web, and any other information that can influence the risk a third party presents to your organization.
There are also opportunities to automate the categorization and inventory management of third parties. Once your organization has identified all the third parties that have access to your environment and have started the process of scoring and categorizing them, automation solutions can help your team manage the results.
Automating inventory management also makes it easier to track changes over time and maintain an updated database of third parties.
Automating Risk Assessments
Automation can play a key role in speeding up the assessment process, especially in more thorough and extensive assessments for third parties.
Questionnaire-based assessment technologies often fall into GRC solutions and technologies. These technologies automate questionnaire creation, risk scoring, delivery to third parties, communication during the assessment, response management, and report development.
Vulnerability and technical assessment automation is usually done through vulnerability management technologies. These automate scan scopes, scan performance, integration with vulnerability databases, risk scoring, and report development.
Using these solutions makes the process of conducting third-party risk assessments more efficient, which can reduce the time to remediation, as well as the amount of time that exploitable vulnerabilities go unaddressed in an environment.
The key to a successful automation technology is choosing one that integrates with your existing processes and makes sense for managing your third parties and vendors.
Integration with Overall Risk Management
No matter what technology you use, it should integrate with your organization’s overall risk management program. This can aid key decision-makers in understanding risk for individual third parties and suppliers, as well as how it impacts risk throughout your organization.
An automation solution should integrate into your security program’s overall risk reporting, risk treatment tracking, integration into the risk register, and remediation plan development and management.
Dynamic Risk Scoring Solutions
As automation technology continues to mature in cyber security, more dynamic risk scoring solutions are being created.
Dynamic scoring solutions are developed to automate multiple aspects of the third-party risk assessment process.
These can be valuable for categorization, as dynamic scoring can use different types of information to identify what risk a third party can present to your organization. It automatically considers the level of access they have to your environment, the types of data they handle, along with any publicly available information or any internal characteristics gathered through pre-assessments.
A dynamic scoring solution can also continue to measure and monitor your third parties after completing an assessment. This makes it easier to see how a third party’s risk score changes over time as remediation is completed or other changes are made to their environment.
Regardless of the automation technology used, whether GRC-based, technically focused, or dynamically changing, automation solutions can’t replace your security program’s processes.
Develop your process steps and areas first, and then use automation technology to make them more efficient and effective.