Importance of Risk Assessment in Third-Party Risk Management Strategy

February 02, 2022by Smarsh

In the modern business world, especially in regulated industries, companies from healthcare to finance are required to manage increasingly heavy workloads and significant amounts of data. For many organizations, this requires reliance on the help of third-party vendors to keep costs low and operations running efficiently.

The sharing of sensitive data that comes with working relationships like these demands a comprehensive risk management strategy. Risk assessments are a cornerstone in maintaining the cybersecurity of organizations, and your company relies on these measures to protect its critical data from a breach.

When entrusting an external vendor with your critical data, it is key that you choose the right assessment to ensure that they are vetted properly, but these assessments are often complex and difficult to understand.

Here’s an overview of several common frameworks or risk assessments and how they can help protect your organization against cybersecurity threats.

SIG Lite / SIG Core

The SIG questionnaire was developed with third-party relationships in mind. This type of relationship brings with it inherent vulnerabilities that organizations must address in order to protect their data, as well as their reputation on the whole.

It is important to collect information about potential vendors before agreeing to grant access to your most sensitive data. The SIG questionnaire provides a standardized and efficient way to identify risks, evaluate compliance to industry standards, and ensure productive and profitable relationships for all parties.

The SIG questionnaire is an extensive, highly detailed survey of various topics and applications, and not every vendor requires such rigorous evaluation. Those who carry less risk may be better suited for SIG Lite. SIG Lite takes the overarching concepts of the SIG questionnaire and condenses it to a brief set of questions. It allows companies to vet their vendors, without subjecting each one to the same stringent review.

Similarly, every question on the SIG questionnaire may not be relevant or necessary for every vendor. SIG Core is a question bank that allows companies to select their own questions to use in their evaluations, ensuring that they gather the information necessary without wasting extra time on unneeded subjects.

AITEC Due Diligence Questionnaire

An important purpose of risk assessment questionnaires is to gain insight into the internal processes, standards, and capabilities of a particular vendor. The AITEC’s Due Diligence Questionnaire (DDQ) was designed to help hedge fund and alternative asset managers utilize critical questions in assessing potential business partners for compatibility and compliance.

In third-party risk assessments, the AITEC DDQ helps AITEC members to identify and mitigate potential risks before allowing a vendor access to sensitive data. The questionnaire will collect information about a vendor’s policies, protocols, and data security measures, all of which can be used to develop best practices that ensure an appropriate standard is upheld throughout the life of the working relationship.

National Institute of Standards and Technology (NIST) Cybersecurity Framework

The Cybersecurity Framework (CSF) is the National Institute of Standards and Technology’s answer to the growing threat of cybersecurity attacks. The framework identifies several functions of cybersecurity activities:

Identify: Develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data, and capabilities.

Protect: Develop and implement appropriate safeguards to ensure delivery of critical services.

Detect: Develop and implement appropriate activities to identify the occurrence of a cybersecurity event.

Respond: Develop and implement appropriate activities to take action regarding a detected cybersecurity incident.

Recovery: Develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to a cybersecurity incident.

Within these functions are categories and subcategories identifying various outcomes and controls which offer a more specific understanding of targeted areas of need.

Existing reports generated through other assessments can be better understood when analyzed through CSF. While traditional methods of reviewing risk assessments are time consuming and nonuniform, applying this framework provides structure and efficiency to an otherwise laborious process. With CSF, your organization can quickly and accurately assess security standards of third-party vendors and keep your systems protected against potential threats.

Business Continuity and Disaster Recovery

At any given moment, an unforeseen crisis could strike, causing an organization to have to rapidly respond and restructure accordingly. Whether it be a natural disaster, a ransomware attack, or a global pandemic, every business needs a business continuity and disaster recovery (BC/DR) plan.

While your organization may already have a rock-solid BC/DR plan in place, the third-party vendors you work with may not. If you do not ensure that your vendors are ready for the unknown, you leave your organization vulnerable to the consequences that come with being unprepared for a crisis.

A critical part of assessing third-party risk is guaranteeing that vendors have a sufficient plan that is up to your organization’s standards. Your risk assessment process should include a thorough review of their BC/DR plan to make sure that your shared data is protected, even in a disaster.

FCPA / Anti-Corruption

In 1977, the United States passed the Foreign Corrupt Practices Act. The law forbids individuals or organizations from offering a bribe to a foreign official for the purpose of benefiting a business arrangement. Intended to protect against corruption, the law is enforced by the Department of Justice and the U.S. Securities and Exchange Commission.

According to Stanford Law School, approximately 90% of FCPA cases involve the use of a third party. It is critical that your organization is proactive about continually evaluating and mitigating risk in your dealings with vendors to avoid being held liable should corruption occur.

Companies that do not thoroughly vet their vendors are at risk of facing charges for turning a blind eye to corruption. Risk assessment protects the integrity of your organization from compromise, even in the case of FCPA non-compliance.

Privva uncomplicates the process of creating comprehensive risk assessment strategies to protect your organization from third-party threats. If you’re ready to streamline your risk management process, reach out today to see how Privva can help.

Share this post!

Author
Recent Posts

Smarsh

Smarsh® is the recognized global leader in electronic communications archiving solutions for regulated organizations. Smarsh provides innovative capture, archiving, e-discovery, and supervision solutions across the industry’s widest breadth of communication channels.

Scalable for organizations of all sizes, the Smarsh platform provides customers with compliance built on confidence. It enables them to strategically future-proof as new communication channels are adopted, and to realize more insight and value from the data in their archive. Customers strengthen their compliance and e-discovery initiatives and benefit from the productive use of email, social media, mobile/text messaging, instant messaging and collaboration, web, and voice channels.

Smarsh serves a global client base that spans the top banks in North America and Europe, along with leading brokerage firms, insurers, and registered investment advisors. Smarsh also enables state and local government agencies to meet their public records and e-discovery requirements. For more information, visit www.smarsh.com.

Latest posts by Smarsh (see all)

Strategic Partnerships Highlighted at SmarshCONNECT 2024 - April 15, 2024
What Are Financial Firms Saying About 2023’s Regulatory Squeeze? - January 10, 2024
Form ADV Amendments: Frequently Asked Questions (FAQ) for RIAs - December 6, 2023

Smarsh Blog

Our internal subject matter experts and our network of external industry experts are featured with insights into the technology and industry trends that affect your electronic communications compliance initiatives. Sign up to benefit from their deep understanding, tips and best practices regarding how your company can manage compliance risk while unlocking the business value of your communications data.

Ready to enable compliant productivity?

Join the 6,500+ customers using Smarsh to drive their business forward.

watch it work

More Resources