Next Generation Vendor IT Risk Assessment

Organization’s around the world use a very standard process for IT risk assessment for all their vendor . Generally, the process involves sending a long set of questionnaires to these vendors, evaluating the answers from vendors and then taking a risk based decision of either approving or denying the vendor.

A general process is shown by the below diagram:

Traditional vendor IT risk assessment Process

The above diagram shows the traditional vendor IT risk assessment process in a clock-wise manner. The thing to note is that this is an overarching process and there are many sub tasks in each step of the process. Though this process is efficient and has worked very well for the Information security community but it has become cumbersome in the 21st century . The advent of cloud based vendors(SaaS services) has made the process obsolete and excessively time consuming .

Get Arjit Srivastava’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Some of the major disadvantages of this traditional approach are :

1. No new innovation has taken place in this space for a while . The industry is still reliant on Microsoft excel for exchanging answers.
2. The traditional approach is resource intensive i.e If an organization has a lot of vendors then it needs a large number of information security professionals to manage the vendor IT risk assessment process.
3. The process is still linear in nature and there is rarely a continuous vendor security program in organizations . The assessments are done once a year while breaches can happen anytime.
4. Since the process is still mostly run on microsoft excel and other old generation tools there is no clear data analytics on the data collected that can show security risk trends and help determine the statistics like riskiest vendors,weakest control , vendors complying to security standard etc.

All the above disadvantages in the traditional approach exists because Vendor IT risk programs are run and managed by information security people who are more focused on managing the security risk than making the program more efficient for all parties . Also, the nature of IT industry has changed in the last 10 year with most of the vendors now using the cloud on the back-end which has reduced the barrier of entry for these vendors significantly . Major organizations across the world now prefer to use these subscription based SaaS vendors rather than developing in-house applications . Hence , we need to revamp the vendor IT risk assessment process to align with the changing times.

The proposed solution:

The Information security industry needs to start distinguishing the vendor risk assessment process as a data play rather than a security process.There is huge amount of data about each vendor that gets collected as part of the vendor risk assessment process. It first needs to be stored in a centralized location using “Big data” so that it can be indexed properly and then fed into a data analytics pipeline to make sense of that data. In fact , most of the decisions that humans make looking at the vendor answers can be made using data analytics and machine learning. For e.g . A “CAIQ” can be mapped to the most important Key controls and analysed using machine learning .

For Questionnaires like Vendor security alliances VSAQ which requires detailed answers from vendor , machine learning models for Sentiment analysis and classification can be used to analyze the answers and make a final decision . This approach can be applied to customized questionnaire’s as well . This would enable organizations to manage the large number of vendors in their catalog and extract relevant analytics for each vendor.

This blog will be continued by another blog that practically shows how the next generation of vendor IT risk assessment can be achieved with code snippets and examples.