Vendor risk assessment matters because the privacy of your customers’ data is only as good as the riskiest vendor in your supply chain. A breakdown of how vendor risk impacts your customers through the backup service provider channel, and what you should ask for from every vendor.
Your security stance is just one half of the story. If your vendor is keeping your customers’ data safe on your behalf – a backup service provider, for example – you have an even greater security liability that extends beyond your control.
How a Vendor Risk Assessment Typically Works
Vendor risk assessments assess the security position of a third party before (and after, periodically) working with them on information that is critical to your business. This will include the assessment of their certification, asking for certain documents, and how their procedures meet yours.
What questions customers/auditors ask about your vendors
Not only do customers and auditors ask about your controls, but more and more, they’re asking about your vendors: “Who holds my backup? What certifications do they have? What controls are they maintaining?” The ability to answer those questions definitively, with supporting documentation, has become an important part of your security narrative. For a deeper framework, see NIST’s guidance on supply chain risk management.
Why backup providers specifically deserve scrutiny
A backup provider typically holds more than most vendors
Unlike most other SaaS solutions that only affect a small fraction of your data, a backup provider is likely to have the entire collection of your data protected. This means that their security practices are more relevant to your security needs than any other vendor.
Documentation to request from any vendor
Building this into your own vendor management process
Formalize this into a standard process instead of a one-off test during the sign-up phase – a basic checklist that is performed regularly for any vendor that handles sensitive data. This way, you have something to point to when you get asked how you manage vendor risk.
Frequently asked questions
Q: How formal does our vendor risk assessment process need to be?
It depends on the size of your organization and how sensitive the information that your vendors have access to is. A smaller company may simply have a documented checklist, whereas a bigger company would probably have a more formal process for doing an assessment on a regular basis.
Q: Should we assess a backup vendor differently than other SaaS vendors?
Yes, certainly to some extent because a backup service provider usually maintains a fuller record of your data than most other SaaS solutions, thus putting them at greater security risk. It is only appropriate that you should consider this when assessing such providers.
Q: What if a vendor won’t share the documentation we’re asking for?
Treat it as a useful signal. A vendor who is confident about their security measures does not have any problem with sharing certifications and other details without being asked.
Q: How often should we re-assess our existing vendors, not just new ones?
At least annually and sooner if there is any change to the vendor’s infrastructure, ownership, or security incident. The risk associated with the vendor is not something that is determined once during sign-up but on-going.
Conclusion
Vendor security is increasingly interlinked with your own. Treating vendor risk assessment as a conscious part of your security process protects the trust of your clients and yourself.
Dev Gupta
VP Security & Compliance at Softyz Inc. Dev is CISSP certified and an ISO 27001 Lead Auditor, and has guided customers through building vendor risk management processes that hold up under audit scrutiny.