Yes, I'd request as much information as reasonably available. Certainly, all of the things like a reputation risk check, history of data breaches, articles of incorporation all come to mind - additionally, I'd request copies of their business continuity ... More
We are reevaluating our vendors level classification and I would to know how are other agencies treating federal government entities like Fanny Mae, VA, or your State Housing authorities. These are agencies that store and process our customer's NPI and ... More
This message was posted by a user wishing to remain anonymous I have a vendor hosting an application in the cloud and due to the "shared cloud responsibility", I'm wondering if requiring reports (i.e. output of trusted advisor, is IAM used?, cloudtrail ... More
Hello Mark and welcome to the wonderful world of Vendor Management! I'll try to answer your questions with our practices below: We are early in our formal Vendor Risk Management process. As we roll out our ongoing vendor oversight and monitoring ... More
Hi! We have a process in place which is similar to what you describe. For document reviews, such as SOC reports, and information security items, we partnered with various stakeholders (like internal audit, information security) to identify thresholds ... More
Log in to see this information