Third-Party Risk Management: Vendor Security Assessment

Evaluate and manage security risks from vendors and partners.

Third parties are involved in most data breaches.

Assessment Areas

- Security policies and procedures
- Technical controls
- Compliance certifications
- Incident history
- Data handling practices

- Security questionnaires
- SOC 2 reports review
- Penetration testing
- On-site audits
- Continuous monitoring

- SecurityScorecard
- BitSight
- RiskRecon
- OneTrust
- Prevalent