NERC Security Guideline for the Vendor Risk Management Lifecycle

Gather information about the vendor’s mitigation plans for specific supply chain cyber security risks, using a targeted assessment containing only relevant questions.

Use a customizable assessment to gather and correlate vendor controls to determine threats to systems and data, based on the criticality of the vendor.

Collate data in a single risk register with heat map reporting that measures and categorizes risks based on likelihood and impact. With this insight, teams can easily see the consequences of a risk.

Include cyber security terms and conditions in the vendor contract, or identify specific deliverables to be measured.

Leverage a contract lifecycle management solution that centralizes the distribution, discussion, retention, and review of vendor contracts. Doing so will ensure that key contractual provisions, such as key performance indicators (KPIs), key risk indicators (KRIs) and service level agreements (SLAs), are included in vendor contracts and are enforced throughout the relationship.

Provide supporting evidence such as certifications or audit reports by qualified third-party assessors.

Request that the vendor provide a software bill of materials (SBOM) listing all components of their software and/or firmware that were developed by third parties.

Perform a procurement risk assessment (PRA).

Mitigate every high risk identified in the PRA.

Centralize documents, supporting evidence and vendor certifications into a single vendor profile associated with completed vendor risk assessments and a central risk register.

Deliver recommended remediations to vendors based on risk assessment results to ensure that vendors address risks in a timely and satisfactory manner. Track remediations to conclusion with defined owners – inside your organization and in your vendor’s organization.

Focus questions specifically on protecting remote access through multi-factor authentication.

Use a questionnaire that asks only relevant questions.

Have separate questionnaire for IT and OT vendors.

Consider certifications such as ISO 27001 or SOC2.

Automate risk assessments to extend the visibility, efficiency and scale of your vendor risk management program across every stage of the vendor lifecycle.

Leverage a library that includes hundreds of standardized assessment templates – including questionnaires that target IT and OT domains – with customization capabilities and built-in workflow and remediation to automate everything from survey collection and analysis to risk rating and reporting.

If the vendor is unable or unwilling to complete a standardized assessment, map ISO certifications or SOC 2 reports into the central risk register view manage risks from that vendor alongside the risks gathered from other vendors’ assessments.

Validate assessment results with continuous insights into cyber threats. Consolidating all intelligence into a “single pane of glass” will optimize your risk analysis efforts.

Include RFP language identifying security risks and any mitigations the vendor must undertake to address those risks.

Centralize and automate the distribution, comparison, and management of requests for proposals (RFPs) and requests for information (RFIs) as part of vendor selection decisions. Doing so will ensure that suppliers are selected based on critical cyber security measures.

Include contract language documenting the vendor’s commitment to implement specific security controls, provide for the organization to review the vendor’s progress, and identify methods for future communication on these matters.

Centralize the distribution, discussion, retention, and review of supplier contracts. Managing supply contracts this way will ensure that you have the proper security clauses and enforcements built into the contract.

Define specific remediations.

Deliver recommended remediations to suppliers based on risk assessment results to ensure that suppliers address risks in a timely and satisfactory manner. Track remediations to conclusion with defined owners – inside your organization and in your supplier’s organization.

Document and communicate with the vendor the gap in performance, the expected service, and applicable contract terms or documented commitment.

Customize surveys to make it easy to gather and analyze necessary performance and contract data in a single risk register. Identify key contract attributes relating to SLAs or performance, populate those requirements in a central platform, and assign tasks to you and your vendor for tracking purposes.

Communicate to the vendor that performance measures will be reflected in future scoring or evaluation of new purchases of products or services.

Centrally measure vendor KPIs and KRIs against your requirements by automatically extracting them from the vendor contract.

Suggest remediation recommendations to ensure that vendors address risks in a timely and satisfactory manner.

Evaluate terminating the relationship with the vendor.

When a termination or exit is required for critical services, leverage customizable surveys and workflows to report on system access, data destruction, access management, compliance with relevant laws, final payments, and more.

Identify and mitigate the risks associated with the termination or transition (e.g., holding sensitive information).

Take an inventory of the sensitive information that the vendor holds about the organization’s systems and networks and require the vendor to attest that all information has been deleted.

Automate contract assessments and offboarding procedures to reduce your organization’s risk of post-contract exposure.

• Schedule tasks to review contracts to ensure all obligations have been met. Issue customizable contract assessments to evaluate status.

• Leverage customizable surveys and workflows report on system access, data destruction, access management, compliance with all relevant laws, final payments, and more.

• Centrally store and manage documents and certifications, such as NDAs, SLAs, SOWs and contracts. Leverage built-in automated document analysis based on AWS natural language processing and machine learning analytics to confirm key criteria are addressed.

• Take actionable steps to reduce vendor risk with built-in remediation recommendations and guidance.

• Visualize and address compliance requirements by automatically mapping assessment results to any regulation or framework.