Have you created a vendor assessment questionnaire that is specific to consultants and integrators that only have either limited access, time-bound access that is controlled, or no access but are involved with designs, data, or exposed to sensitive information? I am looking to streamline my TPRM questionnaire for consultants and integrators. I've used the SIG and SIG lite, and used the SIG Manager to customize the domains. Not all questions that you can ask in an assessment are equal when you take the details of access and exposure into account. I want to have a specific set of questions to help us really assess the risk for this type of vendor.
Sort by:
Director of Systems Operations in Healthcare and Biotech2 years ago
Sounds like you are on the right track, but depending on the industry, and location additional criteria may need to be set. But in general when trying to really address vendor risk, questions about what systems utilized, their onboarding / offboarding process, location of sub vendors, as well as what certifications they have and how they audit themselves are always good questions to include.
Prioritize questions about the duration and scope of access, the nature of sensitive data exposure, and specific security protocols implemented during their involvement, ensuring a targeted and effective risk assessment tailored to their unique roles and responsibilities.