When organizations foster mutually beneficial relationships with third-party vendors, which improves their ability to achieve business goals, as they gain a competitive advantage over their rivals.
The problem is that every third-party vendor with access to protected internal resources represents yet another possible attack vector for cybercriminals to target. In fact, 61 percent of US companies have experienced a data breach caused by one of their vendors or third parties.
That’s why organizations can no longer afford to focus only on their own cybersecurity defenses. Instead, they must also assess the cybersecurity posture of their third-party vendors and sever ties with those that don’t take cybersecurity seriously, which is where vendor risk assessment questionnaires come in.
Download
DoD Contractor’s Guide to CMMC 2.0 Compliance
What Is a Vendor Risk Assessment Questionnaire?
A vendor risk assessment questionnaire, sometimes referred to as a third-party risk assessment questionnaire, is a document containing a series of questions to reveal potential security gaps of a third-party vendor.
The filled-out vendor risk assessment questionnaire delivers critical information about the vendor’s cybersecurity posture in a uniform, easy-to-understand format that makes it much easier to determine whether the assessing organization is compatible with the vendor.
Vendor risk assessment questionnaires are typically sent to vendors before a contract is signed, but they can also be sent to existing vendors—and not just once. In fact, requiring vendors to fill out vendor risk assessment questionnaires on a regular basis (such as once a year) can help get a more comprehensive picture of the evolution or devolution of their cybersecurity.
Ultimately, the goal is to avoid the consequences of third-party data breaches, which include:
- Financial loss: Data breaches cost SMBs, on average, $200,000 because they create downtime, cause sales and operational disruption, and lead to missed opportunities, and more. Unsurprisingly, many organizations never recover after a third-party data breach.
- Reputation damage: When an organization suffers a data breach because one of its vendors had failed to implement sufficiently strong cybersecurity defenses, it reflects negatively on the organization’s own cybersecurity posture. Organizations whose reputation has been damaged find it more difficult to attract customers and business partners alike.
- Legal risks: As far as data protection and privacy regulations are concerned, data breach is a data breach no matter where it originated from. When an organization decides to store sensitive data, such as personally identifiable information, on servers belonging to a third-party vendor, it still has the same responsibility to protect it as if the data was stored on its own servers.
How to Create a Vendor Risk Assessment Questionnaire?
Creating a vendor risk assessment questionnaire doesn’t have to be a laborious process. It’s a standard practice to begin with an industry-standard security assessment template and modify it to reflect the unique nature of each third-party vendor.
Let’s take a closer look at several commonly used templates that provide a great foundation for creating vendor risk assessment questionnaires.
Common Questionnaire Templates:
NIST SP 800-171
The National Institute of Standards and Technology (NIST) publishes a set of standards governing the protection of Controlled Unclassified Information (CUI) in Non-Federal Information Systems and Organizations. NIST SP 800-171 covers 14 key areas, which include everything from access control to physical protection to incident response.
VSA Questionnaire (VSAQ)
Created specifically to help organizations assess the cybersecurity posture of their vendors, VSA questionnaires comprise the most critical questions on vendor security in addition to privacy, covering both US Privacy (data breach notification requirements plus CCPA) and EU Privacy (GDPR).
Standardized Information Gathering Questionnaire (SIG / SIG-Lite)
Over 15,000 organizations worldwide rely on the SIG to measure security risks across 18 risk control areas within a vendor’s environment. The questionnaire aligns with leading domestic and international regulations, and it is regularly updated to reflect changes in the rapidly evolving cybersecurity landscape.
CIS Controls
Published by the Center for Internet Security (CIS), the latest version of CIS Controls details 18 controls to protect critical systems and data from common cyber attacks, starting with Inventory and Control of Enterprise Assets and ending with Penetration Testing.
Consensus Assessments Initiative Questionnaire (CAIQ)
Cloud Security Alliance (CSA) publishes and frequently updates this industry-accepted questionnaire to help cloud customers gauge the security posture of prospective cloud service providers and determine if their cloud services are suitably secure.
Higher Education Cloud Vendor Assessment Tool (HECVAT / HECVAT Lite)
The HECVAT is a questionnaire framework for higher education specifically designed by the Higher Education Information Security Council to measure vendor risk. It was first published in 2016, and it contains around 300 questions.
Are Vendor Risk Assessment Questionnaires Enough?
No, vendor risk assessment questionnaires provide only a small (but useful) glimpse into the cybersecurity posture of your vendors.
To start with, they don’t really reflect the always-evolving nature of cybersecurity policies and controls unless administered frequently, at which point their labor-intensiveness becomes a problem.
More importantly, however, vendor risk assessment questionnaires don’t guarantee that the information provided by them reflects the real state of things. There’s nothing stopping vendors from painting a much nicer picture of their cybersecurity readiness just by being less than completely honest.
Due to these limitations and others, vendor risk assessment questionnaires should be just one part of a larger third-party risk management (TPRM) program, alongside continuous vendor monitoring, for example.
Let’s Develop Your Company’s Vendor Risk Assessment Questionnaire
At OSIbeyond, we’re deeply familiar with the cybersecurity risks stemming from third-party vendors, and we have the skills and experience to help organizations such as yours defend themselves against them.
Get in touch with us for more information.