Cybersecurity
Third-party risk assessments
Vendors with network access, data or code in your products can become your incident. We help you tier them, review the ones that matter and make sure contracts and access match the risk.
The problem this service solves
A long questionnaire sent to every vendor produces a pile of "yes" answers and little insight. Meanwhile, the vendor that can sign in as administrator, or that stores production data, receives the same scrutiny as the one that supplies office furniture.
We start by classifying vendors by access and data, then match review depth to that classification and look for technical evidence, such as SOC reports, penetration test summaries and actual configuration of integrations.
What is in scope
-
Inventory and tiering
Collect vendors, data, access and criticality, then assign tiers.
-
Due diligence
Review SOC 2 reports, ISO certificates, penetration test summaries, policies and architecture for critical vendors.
-
Integration review
OAuth scopes, API keys, network connections and service accounts granted to vendors.
-
Contract requirements
Security clauses, notification timing, audit rights and exit provisions, as technical input to counsel.
-
Fourth parties and subprocessors
Dependencies your vendors rely on.
-
Monitoring
Ongoing review triggers, external signals and annual reassessment.
-
Software supply chain
Dependency review and SBOM practices for software you build or buy.
How the work runs
Classify
Focus effort.
-
1
Vendor inventory
Build a list from finance, IT and business owners.
-
2
Tiering
Define criteria and rate each vendor.
Review
Match depth to risk.
-
3
Tiered reviews
Deeper assessment for critical vendors, lighter for others.
-
4
Integration checks
Inspect actual access granted.
Operate
Keep it current.
-
5
Process and templates
Intake workflow, questionnaires and decision criteria.
-
6
Monitoring plan
Triggers for review and annual cycle.
What you receive
- Vendor inventory and tiering
- Assessment reports for critical vendors
- Integration access review
- Intake process and templates
- Contract security requirement checklist
- Monitoring plan
Tooling and technique
Tool categories describe how we work. They are not a claim of vendor partnership or certification.
Standards we map to
Mapping findings to a framework is not the same as certification against it.
Before we start
What we need from you
- Procurement and finance vendor lists
- IT inventory of integrations
- Contracts for critical vendors
What this service is not
- Legal review of contracts
- Auditing a vendor on your behalf without their agreement
What changes afterwards
- Critical vendors are known and reviewed
- Vendor access follows least privilege
- Intake takes days, not months
Questions people ask
Do you contact our vendors?
Only with your authorization. Many reviews rely on documents vendors already provide.
How many vendors need deep review?
Usually a small fraction. Tiering identifies them.
Related
-
ISO 27001 readiness
Prepare an information security management system: scope, risk assessment, Statement of Applicability, control implementation and internal audit.
-
SOC 2 readiness
Prepare for a SOC 2 examination: scope, control design, evidence collection, gap remediation and a mock walkthrough.
-
DevSecOps
Add security checks to the delivery pipeline: source, dependencies, secrets, infrastructure as code, containers and deployment permissions.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response