To Gauge Risk from Third Parties and Employees, Scalability and Automation Are Essential

We continue our series on assessing third-party risk, where we’re describing scenarios in which an automated, cloud-based system can help you identify security and compliance gaps among vendors, partners and employees.

As discussed in this series’ first installment, it’s short-sighted to put great effort into protecting your IT environment while ignoring the security and compliance policies and procedures of your trusted third parties.

We illustrated this principle with the hypothetical example of two CISOs — Jane and Emily — who almost simultaneously hire the same outsourcer, and grant it privileged access to their respective companies’ sensitive data and IT systems.

A few years on, the outsourcer has run into financial, technological and operational trouble. Emily’s organization detects the warning signs and replaces the outsourcer.  Meanwhile, Jane’s organization remains oblivious until its customer data is compromised when hackers breach the outsourcer’s IT network.

The difference? Emily’s organization had a formal, comprehensive, centralized and automated program for assessing third-party risk, while Jane’s did not.

As Your Business Grows, You Need Automation to Conduct Third-Party Risk Assessments at Scale

No business can operate in a vacuum. In order to compete, organizations need to build an ecosystem of trusted third parties and give them access to their offices and IT systems: vendors, partners, suppliers, service providers, contractors and others.

As a business grows, so does this ecosystem, often expanding into hundreds and even thousands of third parties, a scale requiring organizations to automate risk assessments so the process doesn’t become cumbersome and ineffective.

These audits also need to be done internally, to make sure your employees and managers are complying with your policies and with government regulations, and obviously as a business grows, so does its staff, complicating the in-house assessment process.

These business process control assessments, conducted via surveys, evaluate areas of an organization such as its business continuity plans, physical and environmental security tools and practices, operational risk safeguards, financial standing and human resources procedures.

The traditional way of conducting these risk assessment surveys — emailing questionnaires and tracking responses on a spreadsheet — no longer cuts it. You must automate these polls to ensure the process is agile, accurate, comprehensive, centralized, scalable and uniform across your organization.

Otherwise, organizations won’t be able to find out if they’re doing business with third parties that are putting their organization at risk of customer data theft, IP espionage, brand damage and government fines.

In this post, we describe two scenarios where you need cloud-based, automated risk assessments of third parties and internal staff: Reliance on inefficient, manual processes; and inability to perform internal assessments at scale.

Reliance on Inefficient Manual Processes

Crafting a risk assessment questionnaire on a word processing document, emailing it to thousands of people and tracking responses on a spreadsheet sets you up for failure: This manual process is labor-intensive, time consuming, costly, error-prone and hard to scale.

Shifting to cloud-based risk assessment automation centralizes and streamlines this entire process, including survey design, distribution and processing.

 

Design

Instead of manually re-inventing the wheel for every survey, you can design custom, reusable questionnaire templates using an intuitive, drag-and-drop interface.

For assessing compliance with common regulations, such as HIPAA, PCI, SOX and others you can access a central library of pre-built templates, eliminating the need to create these questionnaires from scratch.

You also get flexible, advanced design options, such as letting respondents delegate questions to others, and requiring attachment of complementary evidence for certain answers.

Distribution

Instead of attaching survey docs to email messages, you send out links to web-based, centrally hosted survey forms.

Processing

Because respondents submit answers online, organizations can track in real-time the progress of their campaigns.

Inability to Perform Internal Assessments at Scale

In addition to monitoring third parties, you must also do internal audits and assessments, but conducting these in large and geographically dispersed companies is a challenge.

To ensure that their organizations’ security policies and business processes are followed, risk management teams must regularly poll employees and heads of business units.

Unfortunately, these teams have been traditionally underserved by software vendors, and have had to rely on legacy, on-premises apps or in-house custom software. While these products may suffice for small scale assessments, they fall short for broad, complex audits whose accuracy is critical to avoid government penalties and manage internal risk.

These old apps must be replaced with modern, cloud-based tools, especially in organizations that have grown significantly, either organically or via mergers and acquisitions. With a cloud-based solution, internal risk assessment teams can centrally manage and automate their tasks, quickly gather and analyze survey data and generate compliance proof.

Qualys Security Assessment Questionnaire

If your company faces one or both of these scenarios, Qualys Security Assessment Questionnaire (SAQ) can help.

SAQ gives organizations tight control over their risk assessments, letting them protect themselves from partners with loose or negligent security practices. SAQ simplifies the design, distribution, tracking and management of multiple internal and external risk assessment surveys from a web-based central console.

No more emailed surveys and manual aggregation of results in spreadsheets:  The cloud-based SAQ automates campaign creation, questionnaire distribution and result analysis at enterprise scale. With SAQ, an organization can quickly and precisely identify security and compliance gaps among third parties, as well as internally among its employees.

Try Security Assessment Questionnaire for free with nothing to install.

In the third installment of this weekly blog series, we’ll discuss two more scenarios: inefficient coordination of employee training and failure to keep up with the ever-changing regulatory burden.