Menu

Articles & Blogs

GoRICO: The TPRM Tool for Third-party Vendor Assessment

July 11, 2024 | By Accorian
TPRM

With the advancement of technology, an organization’s reliance on third-party vendors to keep operations running has increased exponentially. However, increased dependence results in increased information sharing which comes with its own set of risks. According to Verizon Data Breach Investigations Report (2023), 83% of breaches involved external parties and, TPRM (Third Party Risk Management) still continue to be one of the top five challenges CISOs face in 2024 due to ignorant Third-party Risk Management practices.

What are Vendor Risk Assessment Questionnaires in TPRM?

Vendor risk assessment questionnaires are among the most popular methods for managing third-party vendors. These questionnaires provide an understanding of the vendor’s security posture and identify existing or potential vulnerabilities that can lead to a data breach.  These are vital to TPRM, especially when the vendor is handling a critical business function.

A good vendor risk assessment questionnaire includes understanding the vendor profile, background, compliance with regulations, standards, data management, privacy practices, third-party audits, certifications, incident response, recovery plan, access control, and ongoing monitoring. However, managing the vendor risk assessment of hundreds or thousands of vendors on spreadsheets can be tedious and not the most efficient solution. In such instances, using a tool, such as GoRICO, that can perform this task comprehensively is a more streamlined, systematic, and effective route.

Streamline Vendor Assessments with Accorian

TPRM, offered by Accorian, as part of its security consulting services helps reduce financial risk, enhance data security, safeguard reputation, and mitigate regulatory risks. It also includes risk identification and comprehensive vendor risk assessment via a vendor questionnaire.

Why GoRICO?

GoRICO, the governance, risk, and compliance tool, which has been developed inhouse, is a unified platform solution designed to comprehend, fortify, and oversee modern technology-driven enterprises’ accurate security posture, including the vendor risk assessment module. GoRICO’s vendor risk assessment module includes features like customizable questions, risk and criticality-based vendor profiling, end-to-end assessment tracking, automated workflow, evidence-based assessment, and comprehensive insights, which ensures thorough and effortless engagement with vendors.

Vendor Risk Management

Inheriting risk comes with every new vendor relationship. It refers to the risks the vendor poses to the organization at the beginning of a business relationship, which can be related to the nature of the services provided or the third-party vendor’s information security posture. Hence, it is important to categorize vendors based on inherent risk.

GoRICO segregates vendors into critical major, critical minor, or non-critical. A supplier involved in operations, protecting sensitive data, and publishing certifications on its website is a critical major, while a supplier engaged in operations and protecting sensitive data is a critical minor. A supplier who does not have access to critical or sensitive information and does not pose a threat is non-critical.

GoRICO simultaneously oversees the evaluations of multiple vendors; the vendor risk management panel monitors the list of vendors, criticality, contact information for the person in charge, date, status, and action.

Vendor Questionnaire

GoRICO offers customized assessments for vendors, covering domains like attestations, network protection, password management, access control, BCP/DR, and data governance. The assessment manager records vendor evaluation trigger dates, expiration dates, status, and completion scores.

Vendors and assessors communicate via notes. The auditor evaluates vendor assessments based on the evidence and GoRICO’s evidence manager plays a pivotal role in this, as it is responsible for maintaining and collecting the evidence shared by the vendors while ensuring the integrity of the assessment process. Post-evaluation, the status of the assessments changes to approved, failed, or returned. 

Vendor Risk Management Dashboard

GoRICO’s dashboard provides a graphical representation of the assessment results. It highlights the metrics for a combination of multiple vendors, such as the number of critical major, critical minor, or non-critical vendors, the average vendor score, or vendor compliance. The assessments are categorized as completed, approved, in progress, overdue, or failed.

Vendor Risk Assessment Workflow

The vendor assessment workflow from the vendor’s perspective begins with the vendor logging in and answering the questionnaire. The client admin gets a notification and logs in. If all the responses are approved, the vendor is verified. If the responses are not approved, the vendor can resubmit the questionnaire, and the client admin can re-assess the responses. If the responses are not approved, then the vendor verification has failed. Once the vendor assessment is complete, domain-wise reports are prepared, detailing the findings and ratings, and shared with the vendor.

Vendor Risk Assessments L1 and L2

Accorian has a systematic 2-stage TPRM process comprising L1 and L2 assessments. Level 1 (L1) assessments are high-level assessments that, through responses and evidence, ensure an initial understanding of the vendor’s security posture. Based on the evidence, it also provides a solid base for the subsequent L2 assessment.

The Level 2 (L2) assessments thoroughly review every control, process, and document, ensuring a comprehensive understanding of the vendor’s security capabilities. These assessments are thorough and reliable, helping organizations safeguard against potential breaches, financial loss, and reputation damage.

Recap

Organizations have started relying heavily on third-party vendors, leading to higher risks of data breaches. To be secure, organizations can utilize Third-party Risk Management (TPRM) tools like GoRICO, which streamlines vendor assessments with customizable questionnaires and comprehensive insights. GoRICO categorizes vendors based on inherent risk and offers a unified dashboard for monitoring assessments. Its systematic L1 and L2 assessments ensure thorough vendor evaluation, mitigating breaches and financial loss risks.

Recent Blog

Article

Adobe's Common Controls Framework of Industry-acclaimed security standards

Today’s world is an ever-changing scenario with changes to the technology sector happening more frequently than ever due to emerging technologies. The case is quite similar in the field of Cyber Security. There are a few industry-acclaimed cybersecurity standards for governing the processes and execution of these standards. These standards are usually built upon a framework of control objectives that need to be implemented by the organizations to comply with these standards. Compliance is measured in terms of control objectives meeting the compliance criteria and also other regulatory and statutory criteria. Since most of these Cybersecurity standards speak of similar control objectives or lay emphasis on similar control areas, it is advisable to have the ‘Adobe’s Common Control Framework’, which means that if we are able to comply with a single requirement from a particular framework, in theory, we should be able to use the adherence of that requirement for ALL the similar frameworks. There are several approaches to achieving this Adobe's Common Controls Framework both in theory and in practice and will be discussed in detail later on in this article. The most relevant security and privacy frameworks are ISO 27001, NIST, PCIDSS, GDPR, SOC Type 2. There is a significant overlap of controls contained in these standards as all of these standards primarily deal with one requirement which is the protection of data. Protection of information from unauthorized disclosure, compromise, and theft forms the backbone or the building blocks of an Adobe's Common Control Framework. This leverages the fact that similar controls or that the essence of the controls is the same across standards and can be used to gauge the adherence or compliance of an organization to the standard. In actual execution, while gauging the compliance of an organization, the Adobe's Common Controls Framework is not only holistic but can reduce the effort and cost otherwise required by the organization to comply with individual standards. There are two methods of developing the Adobe's Common Control Framework for an organization and there are very subtle differences between the two methods. They are Controls harmonization and Controls Mapping. Controls Harmonization: Harmonization is the creation of a brand-new control language set from several source languages of standards taking into consideration content & context. In theory, the intent and meaning of the words and sentences remain intact, but the language and actual words of the individual standards have been changed with a new harmonized meaning defined. To achieve the usage of a single language as an industry, globally, it would have significant benefits and it would be the most efficient way to operate not only as security professionals but also as humans. Adobe’s Common Control Framework is an example of this type of construct. The benefits of having a single operating language can truly be amazing in terms of effort reduction and cost reduction. Control Mapping: Today, most brilliant and forward-thinking security professionals are using the control mapping method. The main idea behind this method is to keep the original language intact as much as possible while mapping and matching the intent and meaning of each sentence and word. This is the most practical and realistic approach because this is how humans fundamentally interact with each other globally. One can see this working in real life where two different languages are being spoken by individuals and kept mainly intact, but an interpreter or linguist is translating between the two — the map is developed in the mind of the linguist. Some real-life examples of mapping for cybersecurity frameworks can be seen in HITRUST Framework, Cloud Security Alliance Framework, and even the U.S. Government formally...

View More

Article

Risk Management Framework – Managing & Measuring what matters

A risk management program allows you to manage overall information security risk.  It is an approach to identify, quantify, mitigate, and monitor risks.  The reason to look at risk in a comprehensive manner is to make sure no one area is getting too much attention or, too little. Frameworks also help you identify the bigger elements of risk that need review and mitigation. Additionally, it help you to prioritize the treatment of certain risks. The adherence to risk frameworks also helps give your customers comfort that a standard risk management is in place and hence, reduce your audit burden.  Typically, a Risk Management program comprises of the following phases: Risk identification Risk analysis Risk evaluation Risk treatment Risk Monitoring A good risk management framework will have the following characteristics: Comprehensive in types of risks it covers Practical for an organization to implement Updated with current real-world risks Based on controls that can be reviewed and audited Reliable so that your vendors and customers can accept it There are many risk management frameworks that one can choose from and it important to understand the advantages of each. Common risk management frameworks include: NIST CSF SOC 2 ISO 27001 HITRUST NIST (National Institute of Standards and Technology) framework is a comprehensive cybersecurity framework (CSF).  It is very widely accepted across different company sizes and business domains. Most cyber-security professionals are well aware of this framework as it is readily available.  Although widely available and very popular there is no certified third-party audit mechanism. Hence, it can only be self-assessed.   SOC 2 Type 2 is an internal controls report based on the scope you define.  It is widely used in the United States to show the maturity of your controls.  A CPA firm that is part of the American Institute of CPAs (AICPA) conducts the audit & issues an assessment report.  The AICPA does not audit/review the assessment for completeness or quality.  HITRUST CSF is a framework that came leverages NIST, SOC, and ISO along with others to create a more comprehensive standard.  It is widely implemented in the United States by organisations in the healthcare space.  Unlike others, although there are external assessors that are involved in the certification process, HITRUST reviews all assessments and issues the certificate. Additionally, among all the frameworks above it tends to be the most expensive to implement.  It is important to choose a framework that matches your long-term security goals & needs.  At Accorian, we work with all of the above frameworks. We help organizations choose the right framework and aid with the implementation. This is done by augmenting our team into your security team to help steer the rollout, aid with query resolution, choosing of the right controls & workaround during mitigation advisory, facilitating the selection of vendors & products and end to end program management. 

View More

Ready to Start?

Security Compliance & Assessment Services

CONSULTING & ASSESSMENT SERVICES

PENETRATION TESTINGRed TEAM ASSESSMENTS
TECHNOLOGY STAFFING

Contact Info

E. info@accorian.com

T. +1-732-443-3468

Contact With Us

Office Address

Accorian Head Office

6,Alvin Ct, East Brunswick, NJ 08816 USA

Accorian Canada

Toronto

Accorian India

Ground Floor,11, Brigade Terraces, Cambridge Rd, Halasuru, Udani Layout, Bengaluru, Karnataka 560008, India

Ready to Start?​

Drop your CVs to joinourteam@accorian.com

Interested Position

Download Case study

Download SOC2 Guide