Due Diligence and Ongoing Monitoring

Recently, we had a third party/technology vendor that we wanted to onboard. This organization could not supply a SOC Report, due to not having one. Their reasoning was that they do not have one due to the size of their organization. What is your organizations requirements on needing/not needing a SOC report? If they do not have one, do you require any other type of documentation? 

Recently, we had a third party/technology vendor that we wanted to onboard. This organization could not supply a SOC Report, due to not having one. Their reasoning was that they do not have one due to the size of their organization. What is your organizations requirements on needing/not needing a SOC report? If they do not have one, do you require any other type of documentation? 

We have some tiny vendors that are around 3-3- employees, and we do not require a SOC audit from them as they will not have one. What we DO require depends on risk - for a tiny vendor that we don't give PII or anything, we mainly just make sure we have updated contact info in case of an issue. For a tiny vendor that is more involved or higher risk, we would send a questionnaire about their security, risk, and business continuity practices instead. 

I still ask for a SOC audit annually, and save their "we don't have one" response for our own audits.

Recently, we had a third party/technology vendor that we wanted to onboard. This organization could not supply a SOC Report, due to not having one. Their reasoning was that they do not have one due to the size of their organization. What is your organizations requirements on needing/not needing a SOC report? If they do not have one, do you require any other type of documentation? 

Hi Diego, 

Would you be able to share some of the questions you ask in your questionnaire? We are looking to "beef" up our standards for our program. 

We have some tiny vendors that are around 3-3- employees, and we do not require a SOC audit from them as they will not have one. What we DO require depends on risk - for a tiny vendor that we don't give PII or anything, we mainly just make sure we have updated contact info in case of an issue. For a tiny vendor that is more involved or higher risk, we would send a questionnaire about their security, risk, and business continuity practices instead. 

I still ask for a SOC audit annually, and save their "we don't have one" response for our own audits.

Recently, we had a third party/technology vendor that we wanted to onboard. This organization could not supply a SOC Report, due to not having one. Their reasoning was that they do not have one due to the size of their organization. What is your organizations requirements on needing/not needing a SOC report? If they do not have one, do you require any other type of documentation? 

Hi Kelsey!

We use the SIG or SIG Lite questionnaire. For a tiny vendor who is in our "high risk" category, I'd either a) send them the SIG Lite questionnaire and ask them to skip any non-relevant questions, or b) excise any non-relevant questions myself before sending. Then, in subsequent years, I get a pretty good response if I send them the previous year's questionnaire and ask if there have been any changes or updates.

We get our SIG Lite from Venminder, but it can be found elsewhere. We like it because it's standardized across all of our vendors.

https://sharedassessments.org/about-sig/

Hi Diego, 

Would you be able to share some of the questions you ask in your questionnaire? We are looking to "beef" up our standards for our program. 

We have some tiny vendors that are around 3-3- employees, and we do not require a SOC audit from them as they will not have one. What we DO require depends on risk - for a tiny vendor that we don't give PII or anything, we mainly just make sure we have updated contact info in case of an issue. For a tiny vendor that is more involved or higher risk, we would send a questionnaire about their security, risk, and business continuity practices instead. 

I still ask for a SOC audit annually, and save their "we don't have one" response for our own audits.

Recently, we had a third party/technology vendor that we wanted to onboard. This organization could not supply a SOC Report, due to not having one. Their reasoning was that they do not have one due to the size of their organization. What is your organizations requirements on needing/not needing a SOC report? If they do not have one, do you require any other type of documentation?