Third-party and vendor risk management: Security+ explained
Third-party risk management covers a supplier from before the contract to after it ends. Before the relationship, you do due diligence: research suppliers, screen them with requests for information and build a risk profile. During the relationship, you keep assessing and monitoring the supplier's risk, and the contract sets out the security requirements and service levels.
Before the contract: due diligence
NIST CSF 2.0 control GV.SC-06 says planning and due diligence are performed to reduce risks before entering formal supplier or third-party relationships.
NIST SP 800-161 Rev. 1 describes this phase. During market research the enterprise does due diligence on potential suppliers to build a supplier risk profile. It may look at market concentration for the product to find dependencies in the supply chain. It may use a request for information (RFI), a sources sought notice or a due diligence questionnaire to screen suppliers and collect evidence. It should not treat this first due diligence as exhaustive.
Only after that does procurement begin: the enterprise releases a statement of work with a request for proposal (RFP) or request for quotes (RFQ), and evaluates bidders against its supply chain security criteria.
During the relationship: assessment and monitoring
GV.SC-07 says the risks posed by a supplier, its products and services are understood, recorded, prioritized, assessed, responded to and monitored over the course of the relationship. Reviewing a cloud provider's current controls three years into a contract is this ongoing vendor assessment, not due diligence.
SP 800-161 Rev. 1 says that once the contract is executed, the enterprise should monitor for changes that alter its risk exposure, such as supplier structural changes, product updates and geopolitical changes. Contracts should allow termination when the risk cannot be brought back within acceptable levels.
GV.SC-05 says supply chain security requirements are built into contracts and other agreements. GV.SC-08 says relevant suppliers are included in incident planning, response and recovery, and GV.SC-10 covers activities after the partnership ends.
Service-level agreements
NIST SP 800-47 Rev. 1, as quoted in the NIST glossary, describes a service-level agreement (SLA) as a commitment between a service provider and one or more customers. It covers expected performance such as reliability and response times, and how problems are reported and resolved and how the agreement can be terminated.
Where the exam catches people
Believing due diligence and vendor assessment are the same: due diligence comes before the contract; vendor assessment continues during it.
Believing an RFP is the screening tool: an RFI or due diligence questionnaire screens suppliers first; the RFP comes later, in procurement.
Believing initial due diligence settles the supplier's risk: SP 800-161 says it should not be treated as exhaustive, and risk is monitored throughout the relationship.
Believing supplier risk ends with the contract: CSF 2.0 GV.SC-10 covers activities after the partnership or service agreement ends.