[New post] Vendor Tiering Best Practices | UpGuard
admin posted: " Vendor tiering is the key to a more resilient and sustainable third-party risk management strategy. But like all cybersecurity controls, it must be supported by the proper framework.To learn how to optimize your Vendor Risk Management program to greate"
Vendor tiering is the key to a more resilient and sustainable third-party risk management strategy. But like all cybersecurity controls, it must be supported by the proper framework.
To learn how to optimize your Vendor Risk Management program to greater efficiency through best vendor tiering practices, read on.
What is Vendor Tiering?
Before addressing its infrastructure, it's important to recap the primary components of vendor tiering.
Vendor tiering is the process of categorizing vendors based on their level of threat criticality. Each third-party vendor is separated into different threat tiers ranging from low-risk, high-risk, and critical risk.
Vendor Tiering on the UpGuard platform
By doing this, remediation efforts can be distributed more efficiently. Instead of maintaining the same level of risk assessment intensity across all vendors (which in many cases isn't necessary), the majority of risk management efforts can be focused on the vendors posing the highest security risks to an organization.
This ensures security postures remain as high as possible at times, even during digital transformation.
The Benefits of Vendor Tiering
The benefits of vendor tiering is best appreciated by considering its impact on the risk assessment process.
Rather than manually tracking third-party risk profiles, vendors can be grouped by the specific risk assessments they require.
Such an arrangement allows security teams to quickly identify the regulatory requirements of each tier so that entities in highly regulated industries (such as healthcare and financial services) can be monitored with greater scrutiny.
The Vendor Tiering Process
There are two primary strategies for assigning vendors to tiers.
Questionnaire-based tiering - uses a classification algorithm to assign a criticality rating based on questionnaire responses.
Manual tiering - Vendors are manually sorted into tiered based on an organization's personal preferences.
Manual tiering is the more popular method because stakeholders prefer to have greater control over their risk management programs. An objective standard of third-party risk isn't convenient because some businesses have a higher risk appetite than others.
Regardless of whether tiering is questionnaire-based or manual, the third-party risk data must first be collected. This is done either through security questionnaires or vendor risk assessments.
Once collected, a risk analysis is performed to evaluate each specific third-party risk and its likelihood of exploitation, with the assistance of a risk matrix. Both inherent risk and residual risks should be considered.
Risk matrix example
The objective of a risk analysis is to specify how each third-party risk should be addressed - whether it should be accepted, addressed, or monitored.
Vendors linked to a majority of risks that must be remediated could then assign to a critical vendor tier and those with an acceptable risk majority to a less critical tier.
With the essential components of the vendor tiering process summarized, the following best practices framework can be considered in the proper context.
Vendor Tiering Best Practices
The following 4-stepframework will streamline the execution of a vendor tiering program and support an efficient Vendor Risk Management (VRM) workflow.
1. Use Security Ratings to Evaluate Risk Postures
Security ratings offer a more rapid representation of each vendor's security posture by assigning each vendor a score based on multiple attack vectors. Rather than manually completing a risk analysis for each identified vulnerability, security ratings instantly reflect a vendor's estimated security posture, if they're calculated by an attack surface monitoring solution.
This feature also streamlines due diligence when onboarding new vendors.
But this shouldn't be the only third-party risk security control, but rather, a complementary addition to a suite of defense strategies.
This is because security ratings fail to consider the specific risks that have the greatest on their calculation - unless they're supported by a remediation planning feature.
Security rating will also indicate whether a Vendor's tiering classification needs to be evaluated. For example, if a vendor acquires another business with poor security practices, their security rating will drop, reflecting an ecosystem with increased vulnerabilities.
2. Map Risk Assessment Responses to Security Frameworks
Unfortunately, your vendors aren't likely to take cybersecurity as seriously as you do. Because of this, all questionnaire and risk assessment responses should be mapped to existing cybersecurity frameworks to evaluated compliance against each security standard.
The effectiveness of a Third-Party risk management program (TPRM) is proportional to the level of commitment by all parties.
Before establishing any vendor relationship, all expectations pertaining the third-party security must be clearly communicated upfront.
The following areas will address the common communication lapses impacting third-party security.
Identify key decision-making staff across senior management.
Set frequency of cyber-threat reporting.
Business continuity plans in the event of a cyber incident.
Any key security metrics that must be monitored and addressed
Cyber threat reporting expectations as specified in the procurement agreement.
Establish clear roles and responsibilities across all categories of vendor risk management (legal, information security, business continuity, regulatory compliance, etc)
Set resilient service level agreements (SLAs) to prevent the disruption of business processes in the event of a data breach.
Include steep termination costs in contracts (this will ensure vendors actually address all security issues rather than breaking partnerships).
Implement a data backup plan - in the event service level agreements are breached.
Ongoing Monitoring of the Third-Party attack surface
Even after all security controls have been implemented, the attack surface across all risk categories should be continuously monitored. This will not only indicate any sudden lapses in security posture in real-time, but it will also verify the legitimacy of all vendor risk assessment responses.
This is especially an important requirement for high-risk vendors. An attack monitoring solution will instantly alert security teams when a critical vulnerability impacting the supply chain is discovered. Such advanced awareness allows such exposures to be addressed before they're discovered by cybercriminals.
UpGuard Can Tier Your Vendors
UpGuard offers a vendor tiering feature to help organizations significantly increase the efficiencies of their Vendor Risk Management programs.
To support this ultimate objective, UpGuard also offers a remediation planning feature to highlight the specific remediation efforts that have the greatest impacts on security postures.
When used harmoniously, vendor tiering and remediation planning prepares security programs to sustain increasing demands on third-party security.
.jpg)
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.