Optimize Vendor Onboarding by Aligning with Cybersecurity

During the vendor onboarding process, both cybersecurity and procurement manage the amount of risk brought into the organization by new third parties. By integrating your cybersecurity practices into your risk scoring and vendor tiering, you can more precisely determine how a new vendor will impact your security posture, which kinds of risk are less likely to result in a breach and whether a vendor is worth onboarding given the risk they pose to your organization. 

Integrating your cybersecurity practices with vendor onboarding helps you optimize the following: 

• Questionnaire scoping: When you scope your vendor assessments based on your cybersecurity policies and needs, you obtain the right information more efficiently. By identifying where your internal vulnerabilities are, you make it much easier to choose questions that ensure you’re not exposed to threats in those areas. Additionally, by using the same question set to assess your internal and external controls, you reduce duplicative processes and enable more direct comparisons between your security posture and those of prospective vendors. 
• Risk scoring: Every risk manager’s objective is to limit the possibility of a breach event and the impact such a breach would have. Where both internal and external risk scores are powerful tools for determining the level of risk posed to your organization, the best metric for evaluating the likelihood of a risk event is your aggregate risk score, or the risk posed when you consider your organization’s internal posture and its vendors taken together. Only once you’ve aggregated these two risk areas can you make confident decisions about which risks are acceptable and which aren’t. 
• Risk mapping: By mapping each of your external controls to an internal cybersecurity policy, you can increase accountability and visibility between your internal cybersecurity and external third-party risk management teams. If your internal control owners need access to vendor data, they shouldn’t have to chase down third-party contacts—the data should be collected in one place, so they can quickly assess your security posture at any time. 

Vendor onboarding doesn’t have to involve long cycle times: By aligning with cybersecurity during the process, you can get a complete view of your internal and external risk with a single assessment.