Section 10.92 Vendor Assessment

Question 1

Vendor Assessments

Answer 1

Process to evaluate the security, reliability, and performance of external entities

Crucial due to interconnectivity and potential impact on multiple businesses

Question 2

Entities in Vendor Assessment

Vendors

Answer 2

Provide goods or services to organizations

e.g Microsoft

Question 3

Entities in Vendor Assessment

Suppliers

Answer 3

Involved in production and delivery of products or parts

e.g Computer manufacturers might have multiple suppliers to provide processors, memory, harddrives etc

Question 4

Entities in Vendor Assessment

Managed Service Providers (MSPs)

Answer 4

Manage IT services on behalf of organisations

e.g AWS or Google Cloud

Question 5

Entities in Vendor Assessment

Penetration Testing of Suppliers

Answer 5

Simulated cyberattacks to identify vulnerabilities in supplier systems

■ Validates supplier’s cybersecurity practices and potential risks to your
organization

Question 6

Right-to-Audit Clause

Answer 6

Contract provision allowing organizations to evaluate vendor’s internal processes for compliance

■ Ensures transparency and adherence to standards

Question 7

Internal Audits

Answer 7

Vendor’s self-assessment of practices against industry or organisational requirements

■ Demonstrates commitment to security and quality

Vendor to carry out its own internal audits

Question 8

Independent Assessments

Answer 8

Evaluations conducted by third-party entities without a stake in the organization or vendor

■ Provides a neutral perspective on adherence to security or performance standards

Question 9

Supply Chain Analysis

Answer 9

Assessment of an entire vendor supply chain for security and reliability

■ Ensures integrity of the vendor’s entire supply chain, including sources of parts or
products