Vendor risk reviews that show which third parties need attention

• No one has a complete list of the vendors that store your data or connect to your systems.
• Every vendor gets the same long questionnaire, and the answers are rarely read.
• SOC 2 reports are collected but not checked for scope, exceptions, or the controls you're expected to run.
• When a vendor has a security incident, you can't quickly tell what data or access they had.

• Vendor inventory with data types, access, and risk tier
• Review summary for each in-scope vendor, with a risk rating and follow-up actions
• Portfolio view showing where third-party risk is concentrated
• Tiered questionnaire set and review criteria
• Documented intake, review, and reassessment procedure

1. 01

   Inventory

   We gather vendor lists from finance, IT, and procurement, and identify which vendors handle sensitive data or have system access.

2. 02

   Tier

   We agree on risk tiers with you and decide how deeply to review vendors in each one.

3. 03

   Review

   We request and review vendor evidence, follow up on gaps, and rate each vendor's risk.

4. 04

   Prioritize

   We report which vendors need action and what that action should be.

5. 05

   Hand off

   We document the process and train your team to run intake and reassessment on its own.

• NIST CSF 2.0 Cybersecurity Supply Chain Risk Management category (GV.SC)
• Vendor assurance reports, such as SOC 2 reports and ISO/IEC 27001 certificates, read for scope and relevance to how you use the vendor

• Report type and timing: a Type 1 report speaks to control design as of one date; a Type 2 report adds operating effectiveness throughout a period. Note how recent the date or period is.
• Scope and system description: confirm that the services and system you use are the ones described, and which Trust Services Criteria categories are in scope.
• Subservice organizations: see which of the vendor's own vendors the report depends on, and whether each is included (the inclusive method) or carved out. For a carved-out vendor, the report describes the controls it assumes that vendor operates, and you may want that vendor's own report.
• Complementary user entity controls: list the controls the vendor assumed its customers would operate, and confirm you actually operate them.
• Tests and results: in a Type 2 report, read the service auditor's description of tests and results, and follow up on any exceptions with the vendor.
• The opinion and its issuer: check whether the opinion is modified, and why, and confirm the report comes from a licensed CPA firm.

Sources: AICPA & CIMA: 2018 SOC 2 Description Criteria (With Revised Implementation Guidance – 2022); AICPA & CIMA: 2017 Trust Services Criteria (With Revised Points of Focus – 2022)

Read the full guide: SOC 2 Type 1 vs Type 2: which report do you need?

• GV.SC-05: requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other agreements
• GV.SC-06: planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
• GV.SC-07: the risks posed by a supplier, its products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
• GV.SC-08: relevant suppliers and other third parties are included in incident planning, response, and recovery activities
• GV.SC-10: supply chain risk management plans include provisions for activities after a partnership or service agreement ends

Source: NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)

• Vendor lists from finance or procurement, plus existing contracts and questionnaires
• A contact in each business area that owns a vendor relationship
• Authority to request evidence from vendors, or introductions to vendor contacts
• Agreement on who approves risk acceptance when a vendor falls short

• Compliance · 12 min readHIPAA for SaaS companies: when you're a business associateWhen a SaaS or health tech company becomes a HIPAA business associate, what the Security Rule and a BAA cover, and how SOC 2 fits alongside HIPAA work.
• Compliance · 10 min readSOC 2 Type 1 vs Type 2: which report do you need?SOC 2 Type 1 vs Type 2: what each report covers, how the Type 2 review period works, and how to decide which one your customers actually need first.