Security Due Diligence

The purpose of conducting Security Due Diligence on Third Parties is to understand if they maintain an optimal security program and can demonstrate their strength of keeping risk at the minimum. The security posture of your Third Party is gauged by thoroughly vetting the security at the domain and control level. The following as part of Due Care gives a lot of assurance on the existing controls and the security best practices followed

A KEY output of this activity will be to

Almost all Third Parties claim to have implemented the necessary controls, but if they are not effective or are not configured in the right way, the objective of the security policy is not met which defeats the purpose of security.

Creating a comprehensive set of Due Diligence questions by factoring the requirements of

• Industry-recognized security frameworks
• Local and international laws and regulations
• Security baseline standard of your organization
• Client security requirements
• 4th  and 5th Third Parties

gives the flexibility to customize the type of assessment that needs to be performed. It is paramount that organizations define their own security baseline standards for each of the security domains, processes, and Standard Operating Procedures (SOPs).

Based on the Inherent risk derived in the Pre-onboarding, a customized Due Diligence approach is created with varying depth to gain assurance. Some of the key considerations in determining the variations of performing Due Diligence:

A well-defined and comprehensive process to gather security artefacts from Third Parties and validate against the response to the questionnaire ensures reduced iterations to gather data and seek clarifications. Risk Management should align with the larger process followed to manage the Enterprise Risk. Definitions of risk severity, impact and SLAs must reflect the same or on similar lines as in the Enterprise risk. Issue documentation, tracking and remediation should closely be followed up with Risk documentation, tracking and remediation which is a critical activity.

Issues are tangible observations that are captured during the Due Diligence process. These observations could translate into potential risks if they go unaddressed. Such issues need to be centrally managed and tied to a Third Party as a whole instead of the services/products offered by them. Inputs should be taken by other teams performing due diligence and documented to ensure a single view of all types of risks of Third Party. This enables the security team to interpret the precise risk exposure, non-compliance to industry standards or violations of any regulations to the management to understand the impact, should the risk be realized and take risk-informed decisions.

Maintaining a common repository to capture due diligence information enables a bird’s eye view of

• How efficiently is the information managed
• Derive statistics and trends by geography, services, industry and risks
• Generate reports and provide insights to management
• Retrieve information when needed
• Perform an audit on data accuracy and completeness
• Integrate with other reporting tools such as Power BI, Tableau etc.

Legacy Third Parties should be evaluated for their security controls while they are actively delivering services to your organization. Lack of visibility into who and how organizations data is being used violates many internal policies and regulations. Many organizations struggle to get a holistic view of their legacy Third Party inventory and the type of services delivered.