The fastest way to fail during the Vendor Risk Management process is accepting documentation that doesn’t directly apply to the evaluated solution. Many organizations actively develop and implement comprehensive Vendor Risk Management programs with one crucial oversight. I frequently observe the tendency to rely solely on third-party attestations—such as a SOC2 report—as sufficient evidence during an assessment. While a SOC2 Certification provides valuable overview of general control practices, its scope often does not extend to specific systems or services being evaluated.
For example, a SOC2 report from Amazon, where the vendor’s solution is hosted, does not reflect the security controls implemented by the vendor itself. That report only attests to the controls Amazon has in place—not those of the vendor leveraging Amazon’s infrastructure. In this instance, the evaluator should also collect additional information about the Vendor’s security practices, risk management processes, and policies / procedures.
Be diligent and pay attention to the details!
The post Were I’ve seen Vendor Risk Management go wrong, but with the right intentions, with this one crucial oversight misstep… appeared first on Clearwater.
