Picture this: You're looking through your inbox on a busy morning and find an email from your biggest customer with pages of questions for you to answer on your cybersecurity posture – the technology you have in place, how you train your team, how often you test your systems and more. It's a long questionnaire, you're not sure how to answer the questions, and you're at risk of losing the contract if you don't provide the right answers. What do you do?
\r\nThis request is called a third-party risk assessment, and it's becoming more common for small businesses. Filling them out – and having the security measures in place to answer the questions correctly – is increasingly a part of life for small businesses. In this article, I cover what you need to know about third-party risk assessments, including:
\r\nAt its core, a risk assessment is a thorough review of the functions, policies and processes that an organization has in place, either internally or externally, and what risks they introduce to an organization. In a cybersecurity risk assessment, this typically means evaluating the risk of a cyberattack or data breach, but risk assessments can also cover compliance, operational and competitive risk. Risk assessments are frequently driven by regulatory or compliance needs, but increasingly, even nonregulated industries are beginning to evaluate risk.
\r\nA company can run a risk assessment of its own internal processes and procedures, but large businesses are starting to understand how their small business vendors' cybersecurity posture impacts them, and are increasingly running risk assessment of their vendors. This means B2B small businesses are under the gun.
\r\nThis realization that vendors can be a danger is, unfortunately, an astute one. Small businesses collect a lot of sensitive data about their clients, often without realizing it. The sensitive data goes beyond credit card numbers. Here are a handful of examples of small business vendors and the sensitive data they store about their large clients:
\r\nLarger organizations and enterprise companies often have a lot of vendors competing for their business, and for security-conscious or highly regulated businesses, cybersecurity can be an important component of the decision. Even as a small business, choosing a more security-minded vendor for your business needs can be a good way to reduce your overall risk.
\r\nThird-party risk assessments often come in the form of a questionnaire and can be lengthy; some vendors have been asked to answer over 100 pages of questions on their security. Additionally, assessments often come out of the blue – they can be sent before the beginning of a contract or business deal or at any point during the working relationship.
\r\nRisk assessments vary, depending on the organization administering the assessment and the scope of the vendor relationship, but the core focus of the questionnaire is to figure out how the vendor is protecting the client's data. Covered areas often include
\r\nDue to the volume and nature of the requests, IT teams or other parties are often required participants in the submission process. Depending on the questionnaire, you may be asked to provide supporting documentation of your technology, training, and policies, in addition to sharing the results of your testing.
\r\nIn addition to a traditional questionnaire-style assessment, some companies are starting to use technology solutions to evaluate their vendors. These solutions run scans and compile publicly accessible information about the company that contributes to risk.
\r\nWhen you receive a cybersecurity assessment, simply not returning it is out of the question. The companies requesting these assessments often represent a significant book of business, so it's in your best interest to answer the questions promptly and correctly.
\r\nIf you have proper security measures in place, a completed assessment can bolster your business. It can help differentiate your company from less security-conscious competitors and increase your client's confidence in your abilities. Additionally, it gives you a talking point with future clients during the prospecting and sales process.
\r\nOn the other hand, if your business isn't prepared for the assessment, you may be in a tight spot. Failing to show adequate cybersecurity can mean losing the business relationship or contract. Additionally, if you submit an incomplete or insufficient questionnaire, the company requesting the assessment may return it to you, which may harm the business relationship and waste additional time.
\r\nThe risk assessment is high stakes, but if you don't have the appropriate security controls in place, you shouldn't risk reporting false information. Not only is it bad for business and for client relationships, but it can also have significant legal impact and cost. As shown by Delta Airlines' recent lawsuit against their chatbot provider, the vendor could be under liability if there is a cybersecurity incident. In Delta's case, its chatbot company's poor security practices caused a data breach that exposed customer information, even after the vendor signed a contract stating that they complied with standards.
\r\nThird-party cybersecurity risk assessments are a big deal for small businesses, and they're often due back to the requestor in short order. Scrambling to improve your cybersecurity while also answering the questionnaire is unlikely to be effective, so, ultimately, the best strategy is to prepare ahead of time. Here are some steps to take:
\r\nSimply understanding the rationale behind cybersecurity assessments and putting in place basic cybersecurity measures goes a long way towards preparing for an assessment. Work to deploy a comprehensive cybersecurity program to protect your organization and to satisfy assessments, and confirm that you're meeting all compliance requirements for your industry.
\r\nPrepare an internal team ahead of time to assist with assessments and help you work through the details. If you have questions about a specific piece of the assessment, don't hesitate to reach out to the requestor or to your provider – it's better to understand ahead of time than to submit an incomplete response.
\r\nKeep your cybersecurity information, including any relevant documentation, in a safe place that you can easily access in the case of a third-party assessment. Move methodically through the questionnaire and answer questions thoroughly and honestly. Consult with your cybersecurity provider or IT team as needed.
\r\nIf your company frequently receives risk assessments, consider preparing a standard response package that details how your company aligns with common frameworks, such as the standardized information gathering (SIG) questionnaire, and provide supporting documentation. This standard response is easy to submit and may be accepted by the requestor as a substitute for their questionnaire as-is or with shorter supplemental pieces.
\r\nSubmit your risk assessment using the method specified. Keep a copy for yourself in a safe place, as well as any notes for next time. In the case that there are any remediations or improvements necessary in the aftermath of the assessment, work to address them thoroughly through your cybersecurity program. Consider forming a company Standard Operating Procedure (SOP) for how to handle third-party assessments, including who takes responsibility for what portions and where the information is stored.
\r\nThird-party cybersecurity risk assessments can be complicated, but they're increasingly an important part of doing business in the B2B market. A little bit of preparation and diligence goes a long way toward a successful assessment and protecting your business.
\n","docType":"article","guid":"articles_3ad190d69f1f28acf5f6adc4cd55ce6c","lastModified":"2019-10-04T16:00:00.000Z","published":"2019-10-04T16:00:00.000Z","structuredData":null,"subtitle":"Learn how to prepare your small business for a third-party cybersecurity risk assessment.","template":"v1","title":"Are You Prepared for Third-Party Cybersecurity Risk Assessments?","type":"article","author":{"avatar":null,"bio":"I'm the Co-Founder of Defendify, the first all-in-one cyberesecurity platform for Small Business. Defendify makes cybersecurity possible for businesses with under 500 employees through its all-in-one, web-based cybersecurity platform that gives Small Business owners and managers the ability to easily—and holistically—protect themselves with ongoing, affordable, scalable cybersecurity.","name":"Andrew Rinaldi","image":null,"slug":null,"social":{"facebook":"https://www.facebook.com/defendify/","linkedin":"https://www.linkedin.com/company/defendify/","twitter":"https://twitter.com/defendify","website":"https://www.defendify.io"},"status":"enabled","title":null,"type":"New BDC Member","user":{"imagePath":"https://staging.business.com/images/uploads/user/profile/bb472780ba7ffe4eac1f3507e72760a37c3cf.jpg","profile":{"company":"Defendify","jobTitle":"Co-Founder","website":"https://www.defendify.io"}}},"breadcrumbs":null,"channels":{"primary":{"name":"Human Resources","slug":"human-resources"},"sub":{"name":"Hiring","slug":"hiring"}},"meta":{"robots":"index, follow","description":"Third-party risk assessments are becoming more common for small businesses. Find out what cybersecurity assessments are and how you can prepare for them.","title":"How to Prepare for a Third-Party Risk Assessment - business.com"},"parsedContent":{"toc":[{"id":"what-is-a-risk-assessment","title":"What is a risk assessment?"},{"id":"whats-in-a-risk-assessment","title":"What's in a risk assessment?"},{"id":"results-of-a-risk-assessment","title":"Results of a risk assessment"},{"id":"you-received-a-third-party-risk-assessment-now-what","title":"You received a third-party risk assessment. Now what?"}],"json":[{"component":"p","children":["Picture this: You're looking through your inbox on a busy morning and find an email from your biggest customer with pages of questions for you to answer on your cybersecurity posture – the technology you have in place, how you train your team, how often you test your systems and more. It's a long questionnaire, you're not sure how to answer the questions, and you're at risk of losing the contract if you don't provide the right answers. What do you do?"]},{"component":"p","children":["This request is called a third-party risk assessment, and it's becoming more common for small businesses. Filling them out – and having the security measures in place to answer the questions correctly – is increasingly a part of life for small businesses. In this article, I cover what you need to know about third-party risk assessments, including:"]},{"component":"ul","children":[{"component":"li","children":["What a risk assessment is and why they are happening"]},{"component":"li","children":["Goals and components of a risk assessment"]},{"component":"li","children":["Results of successful (and unsuccessful) assessments"]},{"component":"li","children":["How to prepare for and complete an assessment"]}]},{"component":"h2","props":{"id":"what-is-a-risk-assessment"},"children":["What is a risk assessment?"]},{"component":"p","children":["At its core, a risk assessment is a thorough review of the functions, policies and processes that an organization has in place, either internally or externally, and what risks they introduce to an organization. In a cybersecurity risk assessment, this typically means evaluating the risk of a cyberattack or data breach, but risk assessments can also cover compliance, operational and competitive risk. Risk assessments are frequently driven by regulatory or compliance needs, but increasingly, even nonregulated industries are beginning to evaluate risk."]},{"component":"p","children":["A ",{"component":"Link","props":{"href":"https://www.business.com/articles/cybersecurity-risk-assessment/"},"children":["company can run a risk assessment"]}," of its own internal processes and procedures, but large businesses are starting to understand how their small business vendors' cybersecurity posture impacts them, and are increasingly running risk assessment of their vendors. This means B2B small businesses are under the gun."]},{"component":"p","children":["This realization that vendors can be a danger is, unfortunately, an astute one. Small businesses collect a lot of ",{"component":"a","props":{"href":"https://www.defendify.co/cybersecurity-blog/2019/6/11/got-sensitive-data","target":"_blank","rel":"nofollow noopener external"},"children":["sensitive data"]}," about their clients, often without realizing it. The sensitive data goes beyond credit card numbers. Here are a handful of examples of small business vendors and the sensitive data they store about their large clients:"]},{"component":"ul","children":[{"component":"li","children":["Lawyer: Confidential legal information, documents, intellectual property (IP)"]},{"component":"li","children":["Marketing firm: Competitive analysis, marketing strategy, public relations communications"]},{"component":"li","children":["Accountant: Financial data, tax documents, employee and payroll details, banking information"]},{"component":"li","children":["Systems integrator: Security system maps and facility floor plans, security and process documentation, access points and configuration details"]},{"component":"li","children":["Manufacturer: Product designs, engineering schematics, input and output data, process data"]}]},{"component":"p","children":["Larger organizations and enterprise companies often have a lot of vendors competing for their business, and for security-conscious or highly regulated businesses, cybersecurity can be an important component of the decision. Even as a small business, choosing a more security-minded vendor for ",{"component":"i","children":["your"]}," business needs can be a good way to reduce your overall risk."]},{"component":"h2","props":{"id":"whats-in-a-risk-assessment"},"children":["What's in a risk assessment?"]},{"component":"p","children":["Third-party risk assessments often come in the form of a questionnaire and can be lengthy; some vendors have been asked to answer over 100 pages of questions on their security. Additionally, assessments often come out of the blue – they can be sent before the beginning of a contract or business deal or at any point during the working relationship."]},{"component":"p","children":["Risk assessments vary, depending on the organization administering the assessment and the scope of the vendor relationship, but the core focus of the questionnaire is to figure out how the vendor is protecting the client's data. Covered areas often include"]},{"component":"ul","children":[{"component":"li","children":["Cybersecurity policies and procedures"]},{"component":"li","children":["Employee awareness and training programs"]},{"component":"li","children":["Data classification and storage"]},{"component":"li","children":["Technology protection and configuration"]},{"component":"li","children":["Penetration testing and other evaluation methods"]}]},{"component":"p","children":["Due to the volume and nature of the requests, IT teams or other parties are often required participants in the submission process. Depending on the questionnaire, you may be asked to provide supporting documentation of your technology, training, and policies, in addition to sharing the results of your testing."]},{"component":"p","children":["In addition to a traditional questionnaire-style assessment, some companies are starting to use technology solutions to evaluate their vendors. These solutions run scans and compile publicly accessible information about the company that contributes to risk. "]},{"component":"h2","props":{"id":"results-of-a-risk-assessment"},"children":["Results of a risk assessment"]},{"component":"p","children":["When you receive a cybersecurity assessment, simply not returning it is out of the question. The companies requesting these assessments often represent a significant book of business, so it's in your best interest to answer the questions promptly and correctly."]},{"component":"p","children":["If you have proper security measures in place, a completed assessment can bolster your business. It can help differentiate your company from less security-conscious competitors and increase your client's confidence in your abilities. Additionally, it gives you a talking point with future clients during the prospecting and sales process."]},{"component":"p","children":["On the other hand, if your business isn't prepared for the assessment, you may be in a tight spot. Failing to show adequate cybersecurity can mean losing the business relationship or contract. Additionally, if you submit an incomplete or insufficient questionnaire, the company requesting the assessment may return it to you, which may harm the business relationship and waste additional time."]},{"component":"p","children":["The risk assessment is high stakes, but if you don't have the appropriate security controls in place, you shouldn't risk reporting false information. Not only is it bad for business and for client relationships, but it can also have significant legal impact and cost. As shown by Delta Airlines' recent ",{"component":"a","props":{"href":"https://www.cisomag.com/delta-sues-ai-vendor-for-exposing-customers-data-in-2017/","target":"_blank","rel":"nofollow noopener external"},"children":["lawsuit against their chatbot provider"]},", the vendor could be under liability if there is a cybersecurity incident. In Delta's case, its chatbot company's poor security practices caused a data breach that exposed customer information, even after the vendor signed a contract stating that they complied with standards."]},{"component":"h2","props":{"id":"you-received-a-third-party-risk-assessment-now-what"},"children":["You received a third-party risk assessment. Now what?"]},{"component":"p","children":["Third-party cybersecurity risk assessments are a big deal for small businesses, and they're often due back to the requestor in short order. Scrambling to improve your cybersecurity while also answering the questionnaire is unlikely to be effective, so, ultimately, the best strategy is to prepare ahead of time. Here are some steps to take: "]},{"component":"h3","children":["1. Deploy basic cybersecurity measures"]},{"component":"p","children":["Simply understanding the rationale behind cybersecurity assessments and putting in place basic cybersecurity measures goes a long way towards preparing for an assessment. Work to deploy a ",{"component":"Link","props":{"href":"https://www.business.com/articles/small-business-cybersecurity-strategy/"},"children":["comprehensive cybersecurity program"]}," to protect your organization and to satisfy assessments, and confirm that you're meeting all compliance requirements for your industry."]},{"component":"p","children":["Prepare an internal team ahead of time to assist with assessments and help you work through the details. If you have questions about a specific piece of the assessment, don't hesitate to reach out to the requestor or to your provider – it's better to understand ahead of time than to submit an incomplete response. "]},{"component":"h3","children":["2. Prepare your materials"]},{"component":"p","children":["Keep your cybersecurity information, including any relevant documentation, in a safe place that you can easily access in the case of a third-party assessment. Move methodically through the questionnaire and answer questions thoroughly and honestly. Consult with your cybersecurity provider or IT team as needed. "]},{"component":"p","children":["If your company frequently receives risk assessments, consider preparing a standard response package that details how your company aligns with common frameworks, such as the ",{"component":"a","props":{"href":"https://sharedassessments.org/sig/","target":"_blank","rel":"nofollow"},"children":["standardized information gathering"]}," (SIG) questionnaire, and provide supporting documentation. This standard response is easy to submit and may be accepted by the requestor as a substitute for their questionnaire as-is or with shorter supplemental pieces."]},{"component":"h3","children":["3. Organize and submit your information"]},{"component":"p","children":["Submit your risk assessment using the method specified. Keep a copy for yourself in a safe place, as well as any notes for next time. In the case that there are any remediations or improvements necessary in the aftermath of the assessment, work to address them thoroughly through your cybersecurity program. Consider forming a company Standard Operating Procedure (SOP) for how to handle third-party assessments, including who takes responsibility for what portions and where the information is stored."]},{"component":"p","children":["Third-party cybersecurity risk assessments can be complicated, but they're increasingly an important part of doing business in the B2B market. A little bit of preparation and diligence goes a long way toward a successful assessment and protecting your business."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5d9/53b995a215e1a028b458e/1500-0-","caption":"Jacob Ammentorp Lund/Getty Images","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"What to Do if ICE Serves Your Business With a Form I-9 Audit","canonical":"https://www.business.com/articles/ice-serves-i-9-audit/","slug":"ice-serves-i-9-audit","thumbnail":"https://www.business.com/images/content/5e6/64def7b43740a2a8b456e/1500-0-","dek":"Make sure you're prepared should Immigration and Customs Enforcement come knocking.","lastModified":"2020-03-10T15:00:00Z","published":"2018-09-17T18:00:00Z","sponsored":false},{"title":"SBA Loan Default: A Complete Guide for 2020 and Beyond","canonical":"https://www.business.com/articles/sba-loan-default-guide/","slug":"sba-loan-default-guide","thumbnail":"https://www.business.com/images/content/5dc/047af7b437483068b4572/1500-0-","dek":"Here's comprehensive guide to all your questions about SBA loan default, forgiveness and the SBA Offer In Compromise.","lastModified":"2019-11-04T15:00:00Z","published":"2019-11-04T15:00:00Z","sponsored":false},{"title":"Why You Should Develop a Relationship With a Business Lawyer","canonical":"https://www.business.com/articles/business-lawyer/","slug":"business-lawyer","thumbnail":"https://www.business.com/images/content/5f0/87b669c658aa02c8b4583/1500-0-","dek":"The facets of launching a company can be overwhelming. Getting the help of a business lawyer is crucial to your success.","lastModified":"2020-07-10T20:09:00Z","published":"2020-07-10T20:09:00Z","sponsored":false},{"title":"Using Lean Strategies to Achieve Team Synergy and Efficiency","canonical":"https://www.business.com/articles/lean-strategies-team-efficiency/","slug":"lean-strategies-team-efficiency","thumbnail":"https://www.business.com/images/content/5be/480e49c658a51108b458c/1500-0-","dek":"Learn more about lean manufacturing strategies and how to implement them in your business.","lastModified":"2018-11-08T08:00:00Z","published":"2018-11-08T08:00:00Z","sponsored":false},{"title":"The Ultimate Small Business Guide to Credit Card Processing Fees","canonical":"https://www.business.com/articles/credit-card-processing-fees/","slug":"credit-card-processing-fees","thumbnail":"https://www.business.com/images/content/5d2/346547b437454698b4577/1500-0-","dek":"Learn about credit card processing fees and how to negotiate for lower costs.","lastModified":"2020-06-16T10:08:00Z","published":"2017-12-07T08:00:00Z","sponsored":false},{"title":"How to Handle Non-Paying Clients","canonical":"https://staging.business.com/articles/overdue-and-over-you-what-actions-can-you-take-when-a-client-hasnt-paid/","slug":"overdue-and-over-you-what-actions-can-you-take-when-a-client-hasnt-paid","thumbnail":"https://staging.business.com/images/content/5c5/af13754d26d68178b4596/1500-0-","dek":"Contracts, lawyers and collections agencies are a few places to start.","lastModified":"2019-02-03T08:00:00Z","published":"2018-03-16T14:00:00Z","sponsored":null},{"title":"How to Handle Non-Paying Clients","canonical":"https://www.business.com/articles/overdue-and-over-you-what-actions-can-you-take-when-a-client-hasnt-paid/","slug":"overdue-and-over-you-what-actions-can-you-take-when-a-client-hasnt-paid","thumbnail":"https://www.business.com/images/content/5c5/e06719c658a87078b4598/1500-0-","dek":"Contracts, lawyers and collections agencies are a few places to start.","lastModified":"2018-03-16T14:00:00Z","published":"2018-03-16T14:00:00Z","sponsored":false},{"title":"Protect Yourself: LegalZoom Lawyer Discusses How to Shield Your Business From Potential Lawsuits","canonical":"https://www.business.com/articles/legalzoom-laywer-shielding-business-from-lawsuits/","slug":"legalzoom-laywer-shielding-business-from-lawsuits","thumbnail":"https://www.business.com/images/content/5c6/225da9c658ae2398b4592/1500-0-","dek":"Legal compliance in HR issues should be a top priority for every business.","lastModified":"2019-02-08T19:00:00Z","published":"2019-02-08T19:00:00Z","sponsored":false},{"title":"When Bad Reviews Hit: Should You Call Legal or PR?","canonical":"https://staging.business.com/articles/bad-reviews-call-legal-or-pr/","slug":"bad-reviews-call-legal-or-pr","thumbnail":"https://staging.business.com/images/content/555/037373187b1cd468b459c/1500-0-","dek":"Bad reviews can devastate a business, especially a small business. So what do you do when someone falsely defames your business?","lastModified":"2019-07-31T20:57:45Z","published":"2015-05-11T15:00:00Z","sponsored":null},{"title":"When Bad Reviews Hit: Should You Call Legal or PR?","canonical":"https://www.business.com/articles/bad-reviews-call-legal-or-pr/","slug":"bad-reviews-call-legal-or-pr","thumbnail":"https://www.business.com/images/channel/marketing.jpg","dek":"Bad reviews can devastate a business, especially a small business. So what do you do when someone falsely defames your business?","lastModified":"2015-05-11T15:00:00Z","published":"2015-05-11T15:00:00Z","sponsored":false},{"title":"Making Sense of Trademarks: What, When, Why and How","canonical":"https://www.business.com/articles/making-sense-of-trademarks/","slug":"making-sense-of-trademarks","thumbnail":"https://www.business.com/images/content/5a9/980bd51ee478c168b4571/1500-0-","dek":"Should you trademark your intellectual property?","lastModified":"2018-03-02T08:00:00Z","published":"2018-03-02T08:00:00Z","sponsored":false},{"title":"Top 5 Web Development Nightmares: How to Avoid Calling a Lawyer","canonical":"https://staging.business.com/articles/top-5-web-development-nightmares-how-to-avoid-calling-a-lawyer/","slug":"top-5-web-development-nightmares-how-to-avoid-calling-a-lawyer","thumbnail":"https://staging.business.com/images/content/573/f55c52f87b1af23b26aaa/1500-0-","dek":"Here is a list of some of the problems that can arise when outsourcing your web development and how you can avoid them.","lastModified":"2019-07-31T20:55:10Z","published":"2016-05-23T16:00:00Z","sponsored":null}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e00ccda9c658a423d8b4569/HR_People_fizkes_Getty.jpg","canonical":"https://staging.business.com/categories/best-peo-services/","title":"The Best PEO Service Providers of 2021","dek":"Professional employer organization services can simplify your human resource responsibilities. Learn about the best PEOs available for your small business.","slug":"best-peo-services","lastModified":"2021-03-23T19:45:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5d85356c7b43745d448b458d/hroutsourcing_fizkes.jpg","canonical":"https://staging.business.com/categories/best-hr-outsourcing-services/","title":"The Best HR Outsourcing Services of 2021","dek":"Human resource outsourcing services can simplify your human resource responsibilities. Learn about the best HROs available for your small business.","slug":"best-hr-outsourcing-services","lastModified":"2021-03-11T17:15:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e14b61c9c658a7e408b4573/schedule_AndreyPopov_getty.jpg","canonical":"https://staging.business.com/categories/employee-scheduling-software/","title":"The Best Employee Scheduling Software of 2021","dek":"Looking for the best employee scheduling software? We've reviewed the best and cheapest programs.","slug":"employee-scheduling-software","lastModified":"2021-03-05T15:55:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2019-10-04T16:00:00.000Z","template":"v1","title":"Are You Prepared for Third-Party Cybersecurity Risk Assessments?","meta":{"robots":"index, follow"},"docType":"articles","slug":"third-party-cybersecurity-risk-assessments","canonical":"https://staging.business.com/articles/third-party-cybersecurity-risk-assessments/","skipTOC":false}},"staticQueryHashes":[]}