Managing the cybersecurity and privacy risk that is associated with third-party service providers is the "new normal" and is found in most modern statutory and regulatory requirements, as well as private-party contracts. The news is littered with stories of incidents and data breaches associated with third-party providers and that always reflects badly on the company that hired the vendor. People remember the name of the company they entrusted their data to, not the name of the outsourced service provider that actually made the mistakes that lead to the incident.
When you "peel back the onion" and prepare for an audit, there is a need to address "the how" for certain topics, such as vendor management. While policies and standards are designed to describe WHY something is required and WHAT needs to be done, many companies fail to create documentation to address HOW the policies and standards are actually implemented. We did the heavy lifting and created several program-level documents to address this need and the Supply Chain Risk Management (SCRM) is one of those products.
ComplianceForge currently offers one (1) product that is specifically designed to assist companies with proactively managing risk associated with third-parties / vendors / suppliers:
The Supply Chain Risk Management (SCRM) is focused on Third-Party Service Providers (TSP) and suppliers. Using vendors or service providers is a common practice - this may range from bookkeeping, to IT support, to janitorial services, to website hosting and even temporary staffing. What all of these outsourced services have in common is that they expose your company to certain levels of risk that could therefore affect your customers' sensitive data. This "soft underbelly" for companies is well known to hackers and identity thieves as a way to get into companies and steal valuable data.
ComplianceForge
NIST SP 800-161 Rev 1 - Cybersecurity Supply Chain Risk Management Strategy & Implementation Plan (C-SCRM SIP) Product Walkthrough Video This short product walkthrough video is designed to give a brief overview about what the C-SCRM is...
Sooner, rather than later, the US Government's global supply chain will have to transition to NIST 8...
The CMMC 2.0 & NIST 800-171 R2 version of the CMMC Kill Chain introduces the theory of constrain...
It is worthwhile to take a look at NIST 800-171 R3 through a People, Process, Technology, Data &...
NIST 800-171 Rev 3 was released on 14 May of this year, and it contains significant changes from the...
