Reporting

 View Only
Venminder State of TPRM 2024
Back to discussions
Expand all | Collapse all

Free or Inbuilt tool

  • 1.  Free or Inbuilt tool

    Posted 07-12-2023 08:18 AM

    Hi All,

    Our company decided not to go with any tool for TPRM process due to budget constraints.

    Could anyone suggest me a free tool & self-build tool where we I can track all my vendor assessments , renewal, ongoing monitoring & termination.

    Any suggestion or idea how can we track all these. We have around 100 Vendors.

    Thanks

    Srini



  • 2.  RE: Free or Inbuilt tool

    Posted 07-12-2023 09:57 AM

    Srinivasa -

    Before Infoblox purchased a GRC tool, we managed tracking of assessments using Smartsheets. This is not a solution for mailing out questionnaires, but does allow creation of an intake form for new vendor assessments, tracking of status and due dates, and automated email reminders.  I am a bit slammed with our fiscal year end assessments, but I would be happy to meet via Zoom and share some tips and tricks of how to do TPRM on a shoestring.

    Perhaps this would be a good topic for a discussion? I haven't seen much activity on the Bay Area TPRM Slack community lately.  Not sure if you've been part of that group.  KW



    ------------------------------
    Kate Wakefield, CISSP / CIPT / CRISC
    Infoblox Director of GRC

    ------------------------------

    Original Message


  • 3.  RE: Free or Inbuilt tool

    Posted 07-12-2023 10:15 AM

    Srinivasa:

     

    Like Kate, we decided to re-use an existing project management tool for TPRM, in our case Jira rather than Smartsheets (we use both in IT).

     

    We created a new "issue" type for each vendor with the risk categories we are interested in, contact information, etc. and automated the overall risk category assessment and the creation of assigned review sub-tasks under each to the vendor owner. Jira is great for collecting notes/updates as well as files within the "issue" base structure, which is why we chose it.

     

    It's coming along – not complete yet, but I think a workable tool for our needs (about the same as yours, 100ish vendors).

     

    Andy




    Original Message


  • 4.  RE: Free or Inbuilt tool

    Posted 07-12-2023 10:59 AM

    Andy -

    I would be interested to understand how you use Jira. We now manage the assessments in our GRC, but Jira is our issue tracker of choice in the engineering side.



    ------------------------------
    Kate Wakefield, CISSP / CIPT / CRISC
    Infoblox Director of GRC

    ------------------------------

    Original Message


  • 5.  RE: Free or Inbuilt tool

    Posted 07-13-2023 11:41 AM

    Kate:

    As mentioned, I created a new board and issue type for 'vendor' (although there are some places where we've split vendors into multiple buckets because different tools/services have different owners within our org). Then added a bunch of custom fields: Last Review Date, Annual Cost, Cybersecurity Risk [0-10], Contact Information, etc. and the appropriate statuses (for us: Discovery, Implementation, Active, Under Review, Inactive).

    We've just finished the deployment by having daily jobs to calculate the [de minimus]/[average]/[critical] vendor category from the various expense and risk scores and set the priority field (based on written policy). Also there is a daily process that uses criticality and last review date to calculate the next review date, and create and assign a subtask to the vendor owner 30 days before the review is due, and move the 'vendor' issue from 'active' to 'under review' status.

     

    It's minimal, but it's 40x better than what we had, and it will move a lot of this to the appropriate parties.

    Also, as with SmartSheets, there are form and workflow builders that you add in to force review to go through the appropriate people/departments if you're so inclined.

     

    Andy




    Original Message


  • 6.  RE: Free or Inbuilt tool

    Posted 07-14-2023 11:29 AM

    Thank you, Andy, for taking time to provide more details.  I probably won't setup our work in Jira, since we have our new GRC, but I'm seriously thinking about putting together "how to do TPRM on a shoestring" (or something like) which I can present at SecureWorld Seattle or some other local venue.  



    ------------------------------
    Kate Wakefield, CISSP / CIPT / CRISC
    Infoblox Director of GRC
    ------------------------------

    Original Message


  • 7.  RE: Free or Inbuilt tool

    Posted 07-14-2023 12:17 PM

    Thanks Kate.

    Yes, googled about smartsheet, i can consider that as one option.

    I have idea of creating a database in MS Acess & tracking all the vendor data in that, also sending remainder from the tool.

    If your free we can dicuss about this.

    you can reach me on {Phone number has been removed for privacy reasons. Please message the community member directly for contact information. You can find more member details by clicking on their name, which will take you to their member profile.]

    Srinivasa


    Original Message


  • 8.  RE: Free or Inbuilt tool

    Posted 07-15-2023 09:15 AM
    Sure! Happy to set time the week of 7/31. Our fiscal year end is this month and I support contracts as well.  My email is kwakefield at infoblox.com



    Original Message


  • 9.  RE: Free or Inbuilt tool

    Posted 07-12-2023 11:17 AM

    Srinivasa,

    I think risk3sixty has a free version available for their GRC tool.  I don't have any experience with it, but it was the first thing that came to mind when I read your question.  Like others have said, if you have an existing solution that can be molded to your process then there might be an opportunity there, but many times I find that these solutions still need a dedicated SME (and budget) to build out the workflow in a way to fit for a TPRM function.

    Out of curiosity, how are you tracking them now?  


    Original Message


  • 10.  RE: Free or Inbuilt tool

    Posted 07-12-2023 05:27 PM
    This message was sent securely by Mechanics Bank®

    You may want to check out Smartsheets.   It  has ability to create workflows.  Licensing is fairly reasonable and it's user subscription based.     

     

    Veralyn Hensley

    SVP, Director of Vendor Management

     

    Mechanics Bank

     

    image001.png@01D2578C.9B50AFC0

     

     




    Original Message


  • 11.  RE: Free or Inbuilt tool

    Posted 07-13-2023 09:22 AM

    Agreed! Two thumbs up for SmartSheets. It is very flexible and can be configured to do many things, including input forms. They have a comprehensive template library as well.

     

    Bridgette

     

    This email communication, including any attached files, may contain material that is proprietary, privileged, confidential or otherwise legally exempt from disclosure. This communication is intended solely for the use of the individual or entity to which it is addressed. If you are not the intended recipient or the person responsible for delivering this communication to the intended recipient, you are prohibited from retaining, using, disseminating, forwarding, printing or copying this communication. If you have received this communication in error, please immediately notify the sender via return email or telephone.



    Original Message