Establishing a Third-party or Vendor Management program

The approach to this will vary based on the organization’s size and complexity. Generally, companies with business experience would have some form of Procurement and Contract Management (ProCam) program in place. Therefore, Security must ensure that they are appropriately integrated into the procurement process, collaborating with the legal team, paralegals, general counsel, privacy officer, ProCam, and Head Buyers to ensure cyber security involvement in any new vendor engagement process.

Cyber security should assess if the vendor poses any risk to the organization by considering various parameters. At a high level, it should be quickly determined if the new vendor being onboarded will have any interaction points with the organization’s Information systems, either physically, logically, directly, or remotely. If the vendor will not have access to office information, Cyber security can easily approve examples such as Office Depot for procuring office stationery and other equipment, as these vendors typically do not have direct access to organization information.

However, if aiming for the highest maturity level in security, it’s always prudent to evaluate vendors’ cyber security hygiene, availability, and civility. Cyber security should advise both procurement and legal teams of potential risks or concerns that could be addressed as part of the legal contract or identify alternative vendors and providers.

The first step is to identify stakeholders such as the general counsel, privacy officer, procurement, and business representatives. Then, a roadmap should be devised for the future operating model of vendor management, which should include the proper inclusion of cyber security in any new vendor engagement and the renewal of legal contracts with existing vendors.

A process should also be established to assess the risk and business impact of engaging with each vendor, similar to what is done with asset business impacts. This will aid in ranking vendors based on their criticality, from most critical to least critical, in a pyramid structure. Vendors with significant impact should be subject to periodic review by Cyber security, initially involving other relevant stakeholders to keep them informed of any identified concerns.