Proactively Managing Vendor Risk: Coffee & Compliance Webinar Recap

Data breaches are costing companies millions. Even when the cause of the breach traces back to your vendor, you’re still the one who pays the price.

With the global rise of data breaches, companies must be proactive about vendor risk management and maintaining regulatory compliance. 

Companies without a formal vendor risk management program can fall into the trap of auditing a too-narrow scope of vendors when they also need to be looking at which vendors those partners use. But the increase in shadow IT and unauthorized SaaS purchases can make this difficult, and it puts your customers’ data at risk.

In a recent webinar with Vanta, directors of security shared ways for businesses to be more proactive in managing vendor risk and to ensure better compliance across the company. Here are some of their tips:

Start with inventory

Risk management processes begin with inventory. As Gig Walsh, LinkSquares Director of Security and Compliance, says, “You can’t protect what you don’t know you have.” Take stock of what tools the company currently pays for using self-reporting inventories or by tracking purchases through bank statements. This will give you a strong jumping-off point for learning whom you’re sharing your data with – intentionally and otherwise.

Build awareness throughout the organization

Sometimes, other teams don’t report their SaaS purchases (to IT, security, or any other responsible team) because they don’t know they’re supposed to. Facilitating organization-wide awareness of this helps other departments keep security top of mind as they assess and acquire tools. This lets you build security review into the RFP process and encourage teams to consider their risk responsibility, helping your business maintain better compliance.

Prioritize by access to customer data

After taking inventory, you might feel overwhelmed by the sheer number of vendors you use that have access to your data and what that might mean for compliance. Start with the vendors that have access to your customer’s data. Exposing customer data during a breach carries the heaviest fines, so prioritize assessing vendors that introduce the greatest risk.

Repurpose assessment questionnaires

Some companies provide security questionnaires that are hundreds of questions, but yours don’t have to be that long. You don’t even have to create them from scratch. Repurpose questions from SOC 2 reports and ISO certifications, and use tools like Vanta to create any extra questions not covered in those.

Use CLM to track vendors

Without a streamlined or centralized way to track vendors across the entire organization, you’ll always be playing catch-up. Walsh shared how the LinkSquares team uses Contract Lifecycle Management (CLM) to manage any new vendors, which is how he becomes aware of them early on in the process. With CLM, teams can track the status of vendor assessments and automatically review terms for compliance. 

Takeaways

It can be hard to make the case for a full-time vendor risk management position, so security and IT teams have to make room on their to-do lists to manage vendor risk and maintain compliance. Learn how LinkSqaures can help you stay ahead of data privacy and compliance concerns today.