A Third-Party risk assessment is a critical component of a Third-Party Risk Management program. Without understanding how to properly execute these assessments, the efficiency of your TPRM program will remain limited.
This post provides a detailed six-step guide for performing third-party risk assessments in cybersecurity.
Third-party risk assessments uncover potential security risks from third-party vendors and external parties. This critical requirement continues throughout the entire TPRM lifecycle, with varying applicability across its three primary stages:
Critical third-party vendors must be prioritized in risk assessment programs since their potential cybersecurity risks are more likely to be exploited in cyber attacks.
The scope of a third-party risk assessment depends on the level of criticality of the third-party vendor being investigated. For example, third parties requiring access to sensitive data or those integral to supporting your promised service levels to clients must undergo a higher degree of attack vector investigation.
Such third-party vendors (classified as “Critical” or “High-Risk” in a Vendor Risk Management program) require a full risk assessment, one involving security questionnaires mapping to applicable cybersecurity standards.
For all remaining third-party vendors not requiring access to sensitive regions of your IT ecosystem - those classified as “low-risk” - ongoing monitoring of automated attack surface scanning results will likely be a sufficient form of a risk assessment, also known as a partial risk assessment.
Full risk assessments apply to high-risk vendors and involve security questionnaires. Partial risk assessments apply to low-risk vendors with a degree of risk exposure that can be sufficiently tracked with automated risk scanning results.
A third-party risk assessment comprehensively evaluates the potential risks associated with each third-party vendor. Multiple data sources are referenced to form a complete picture of a vendor’s risk profile through a risk assessment.
A third-party risk assessment gathers risk insights across the following risk categories:
Security questionnaires are a specific tool within the risk assessment process. They are used to create a gap analysis between a vendor’s security posture and any regulatory requirements or cybersecurity frameworks they need to align with.
Some popular industry standards security questionnaires could map to include:
For more questionnaire template examples, see the list of questionnaires available on the UpGuard platform.
Third-party risk assessments are broad and comprehensive, covering multiple dimensions of risk. Security questionnaires collect information about specific security practices and regulatory compliance efforts.
The following six-step guide will help you design the most comprehensive third-party risk assessment process.
Every third-party risk assessment process must prioritize critical third-party vendors. Ideally, these vendors should have been already flagged as critical during onboarding.
If you haven’t yet segregated your critical third-party vendors, there are two primary methods of identifying them: relationship questionnaires and superficial attack surface scanning. Both methods encompass the risk assessment process undertaken during the onboarding stage of the TPRM workflow.
A relationship questionnaire gathers high-level intelligence about a vendor’s services, data security, and data handling practices.
Here’s a very simplified example of some of the information a relationship questionnaire could cover:
Superficial attack surface scanning, performed during due diligence and onboarding, uncovers likely security risks associated with all domains in a vendor’s attack surface.
This practice is the first stage of a complete cybersecurity discipline known as Attack Surface Management.
Watch this video for an overview of Attack Surface Management:
Here’s an example 4-stage framework governing a vendor tiering strategy:
Here is an example of a completed vendor tiering strategy, with overviews explaining the reasons for each tiering decision.
In the next step, the focus for critical vendors narrows to the regulatory risk category. Regulatory risks arise from misalignment with regulatory standards, primarily due to poor cybersecurity practices. Compliance with regulations governing your business is directly impacted by the security postures of your vendors, which is why a growing number of regulations are increasing their emphasis on Third-Party Risk Management.
In addition to any regulations governing your business, your third-party vendors could also be required to comply with regulations in their industry. For example, a vendor handling payment processing must comply with the Payment Card Industry Data Security Standard (PCI DSS).
Ideally, all of the primary regulations applicable to each third-party vendor will be determined in Step 1 of this process, either via relationship questionnaire submissions or compliance data collected through the Trust Exchange platform. The objective of this step is to ensure that all applicable regulations, whether stemming from the vendor’s industry or your own, are not overlooked.
All regulations impacting a vendor will determine the set of third-party security questionnaires that must be included in their risk assessment.
Each applicable regulation is likely to have specific cybersecurity standards that will need to be scrutinized with dedicated questionnaires. For example:
The risk exposure data gathered up to this point should be sufficient for you to determine the likely risks associated with each vendor and their degree of severity. Remember, this effort doesn’t need to be detailed; the risk assessment performed in the next step should elevate the dimension of cyber risk data to a sufficient level of detail. The purpose of this step is to estimate the likely degree of effort each risk assessment will require.
Vendor: ABC Corp
For more examples of high-level vendor risk evaluations in different risk contexts, refer to this post on Vendor Risk Management examples.
Establishing a draft third-party risk exposure profile informs the level of focus of subsequent risk assessment activities.
Now, you’re ready to send the actual risk assessment. Each risk assessment will include a unique set of questionnaires, depending on the regulatory and industry standards applicable to each third-party vendor.
For a more detailed overview of what’s included in a risk assessment, refer to this vendor risk assessment example.
Watch this video for an overview of the complete risk assessment workflow.
Inefficient vendor collaboration workflows are among the leading causes of delayed vendor risk assessment, an operational issue that could prolong your exposure to potential third-party breach risks.
Every third-party risk management strategy should be supported by streamlined vendor collaboration workflows, ideally consolidated within your TPRM solution and not dispersed across multiple email chains.
Streamline vendor collaboration is one of the key pillars of a foundationally scalable Third-Party Risk Management program.
Collaboration workflows should cater to all parties involved in service provider security questionnaire completions.
Third-party vendor collaborations are primarily required during security questionnaire completions when clarification is needed the most.
Watch this video to learn how UpGuard solves the complex problem of vendor collaboration during questionnaire processes.
