“By combining depth of information with continuous monitoring, introducing automating to assist in the data collection and analysis, you will be set up to more efficiently and effectively manage your third party risk.”

— Gary Brickhouse, CISO & Vice President of GRC Services, GuidePoint Security

In order to sufficiently address third party risks, typical examination efforts must go beyond the quality of products and services and financial viability of the company, to also include fact gathering for information security concerns.

Things to consider:

  • What data does the vendor have access to?
  • What are they doing with it?
  • Do they have access to our network?
  • What’s the risk to our organization if that third party is breached?