Your security is only as strong as your weakest vendor. Regulators increasingly hold organisations responsible for the risk their third parties introduce.
We design your vendor risk programme and carry out security assessments of critical suppliers on your behalf.
Objectives
- Tier vendors by criticality and data access
- Design assessment questionnaires and evidence requirements
- Assess critical vendors and report findings
- Set up ongoing monitoring and reassessment
Methodology
01
Planning
- Define scope, applicable requirements and critical systems
- Agree audit plan, sampling approach and timelines
02
Fieldwork
- Review of policies, procedures and governance
- Testing of technical and operational controls
- Interviews with process owners and evidence verification
03
Technical testing
- Vulnerability assessment and penetration testing where in scope
- Configuration review of servers, databases and network devices
04
Reporting
- Observations rated by risk with recommendations
- Management responses and follow-up review
Deliverables
Audit plan and scope
Audit report with risk-rated observations
VAPT report where in scope
Remediation plan and follow-up review