A Vendor Risk Management Checklist

1) APIs and connectors to common solutions to automate onboarding

2) Automated template to programmatize vendor onboarding

3) Profiling and tiering assessment and built-in logic to implement a repeatable methodology for assessing vendors

4) Inherent and residual risk scoring and tracking to clearly identify which vendors present the most impactful risks to the business

5) Services to onboard and score new vendors for under-resourced teams

1) Library of hundreds of thousands of verified vendor intelligence profiles to enable faster, more efficient vendor onboarding and risks assessment

2) Large number of out-of-the-box assessment templates that can be customized to address specific mandates or frameworks

3) Custom assessment creation wizard providing flexibility to assess vendors against unique requirements

4) Automated workflows and tasks to accelerate the assessment process and provide a clear path to next steps

5) Centralized documents, contracts, agreements and evidence providing a repository for multiple teams

6) Out-of-the-box reporting against multiple compliance and framework requirements utilizing a single questionnaire to feed answers, saving time

7) Options to outsource the questionnaire design and collection and analysis of evidence to experts to relieve resource shortages

1) Cyber monitoring from deep/dark web for real-time risk intelligence insights

2) Business monitoring from hundreds of thousands of sources providing intel on business, regulatory or legal issues
RESTful API to enable connections to other systems

3) Unified risk register that correlates cyber and business risk events with assessment results to validate of vendor-reported control data

4) Transform incoming vendor cyber and business event data into actionable risks, giving you real-time risk visibility
Trigger actions like sending notifications, creating tasks or flags, or elevating risk scores, accelerating the risk mitigation process

5) Flexible risk weightings that granularly define the importance of specific risks to the business

6) Flagging and categorizing – either automatic or manual – to escalate a risk and route it to the appropriate contact for remediation

7) A matrix that dynamically enables risk analysis based on likelihood of an incident and its potential impact on the business

1) Built-in remediation guidance with recommendations to accelerate the risk mitigation process

2) A unified reporting framework that enables you to map questionnaire responses to any regulatory or industry-standard framework, guideline or methodology

3) Regulatory compliance, framework and guideline reporting for CMMC, ISO 27001, NIST, GDPR, CoBiT 5, SSAE 18, SIG, SIG Lite, NYDFS, etc.

4) Ability to show “percent-compliant” to demonstrate progress on risk mitigation efforts

5) Deep reporting for each vendor and across all vendors

7) Projection of risk scoring over time after remediations are conducted and risks are mitigated

8) Workflows and ticketing to automate communications

9) Reporting across multiple security, compliance and privacy regulations with built-in reporting templates and status

10) Executive and operational dashboards

11) Services to manage the remediation process for constrained teams

1) Proactive and incremental assessments triggered by continuous monitoring insights and findings

2) Proactive and incremental updates and event notifications

3) Continuous cyber monitoring, scoring and alerting

4) Action enablement – automated playbooks

5) Rules and intelligence actions library

6) Behavioral analytics and detection with multi-dimensional analysis