Risk Assessments

​​Does anyone use or have opinions on Third Party Security Ratings Companies such as BitSight, Security Scorecard or Up guard?

This message was posted by a user wishing to remain anonymous

Hi.  Our Cyber group uses Bitsight.  I have no opinion, but I do include rating if we have to risk accept Cyber findings.

Thanks.

​We are using Security Scorecard through Venminder services which gives us a monthly report on our most critical vendors. It's a lot of information to digest, but I use the rating trend as an indicator of potential issues. I do include that information in my risk assessments and I report any serious increase in risk rating to management; CIO, ISO, and business line owner.

This message was posted by a user wishing to remain anonymous

We chose BitSight over SS, and are pleased with it.  Their functionality continues to improve and they listen to their customers.

RiskRecon is another competitor in that space. I would include them in an RFP.