Top 10 Tips for Effectively Assessing Third-party Vendors

Transcription

1 Top 10 Tips for Effectively Assessing Third-party Vendors Presented by: Tom Garrubba, Manager, Technical Assessments Group, CVS Caremark Web Hull, Senior Privacy & Compliance Specialist, Iron Mountain

2 Top 10 Tips 1. One size doesn t fit all and it isn t free

3 1. One size doesn t fit all and it isn t free! The Role Players Regulators & Standard Setters Customers The Corporation and the Business Units The Vendor Subcontractors/down stream vendors Who does the real work? Employees, 3 rd party, mix, other Program Initiation and Alignment Formula for Implementation Centralized Decentralized Who pays for it

4 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment

5 2. Determine what data is in-scope for assessment Who? Regulators (FTC, Federal Reserve, HHS, FDIC, etc.) Industry (PCI) Customers Own criteria What Information? Customer Information Employee information Why? You are compelled to perform due diligence it by law, regulation, standard Your customers demand it as you are putting their info at risk by giving it to another company.

6 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow

7 3. Accurately & thoroughly describe how the data will flow Precisely and completely describe Services the vendor will provide; Customer, employee, & company data and information the vendor will collect and/or have access to What the vendor will do with this data and information. Where this data and information will be processed & stored How the data will get to the vendor Any subcontractors to be used

8 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow 4. Triage risk High, Medium, & Low

9 4. Triage Risk - High, Medium, & Low Why? Focus limited resources Reduce vendor s efforts How? Short questionnaire 10 + questions Who? Business owner & vendor Other benefits Shape/reduce longer assessment

10 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow 4. Triage risk High, Medium, & Low 5. Start with an assessment & data collection instrument

11 5. Start with an assessment and data collection instrument Assessment = A due diligence activity to gain a level of comfort with the overall security, privacy, data protection posture of the vendor Send a questionnaire to them and have it returned for analysis Use an existing questionnaire - SIG Standard Information Gathering - Industry standard questionnaire developed by members of the Shared Assessments ( program Covers all domains of ISO as well as HIPAA-HITRUST, PCS-DSS, CoBIT, NIST, GLBA, Privacy & Cloud Develop & send your own questionnaire Have qualified people assess their responses CISA, CRISC, CISSP, CIPP/US/G/C/IT/IT, Pre-Assessment Phase (i.e., Phase 1) of the VAP Lifecycle

12 5. Start with an assessment and data collection instrument VAP Phase 1: Pre-Assessment Obtain all information regarding the scope of work Find out the data that will be CSTUPD ed Collect Store Transmit Use Process Destroy Converse with the assigned BU and/or the vendor contacts to fully understand what, where, and how s If applicable, determine if the assessment will be handled by an internal or external assessor Send the vendor the questionnaire to be completed

13 5. Start with an assessment and data collection instrument Define Scope Define Data in use (CSTUPD) Distribute questionnaire Phase 1: Pre- Assessment Phase 2: Assessment Perform Kickoff Obtain BU and Vendor Docs Acquire SIG Responses Perform AUP Document CI s Phase 4: Re- Assessment Phase 3: Post- Assessment Reevaluate Data Type Reevaluate Location Risk Scoring Update BU and Vendor Management Track CI s File BU/Vendor Docs Remediate CI s

14 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow 4. Triage risk High, Medium, & Low? 5. Start with an assessment & data collection instrument 6. Trust but Verify - Collect evidence

15 6. Trust but Verify Collect evidence VAP Phase 2: Assessment Have a meeting with the BU and vendor to discuss contacts, deliverables, and timelines Request/Review pertinent documentation from: The BU - Contracts, SOW s, NDA s, BAA s The Vendor - SSAE-16 Type II documents; ISO 27001/2 cert, CMM level, NAID, Review the returned questionnaire responses Note contingent items (non-compliant items, findings, etc.) Update BU and Vendor Management Track Contingent Items Compose the assessment report File BU/Vendor Documents Track through remediation all contingent items

16 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow 4. Triage risk High, Medium, & Low? 5. Start with an assessment & data collection instrument 6. Trust but Verify - Collect evidence 7. Accept or remediate non-compliant findings

17 7. Accept or remediate non-compliant items Contingent Items (aka: issues, findings, observations, notable items, etc.) You can accept the risk associated with a particular item or You can require remediation of the item Require remediation by the vendor or business unit Risk-rate and prioritize as such Actively monitor until they are closed Escalate to appropriate levels of management if timelines are not met Adjust the timelines if the vendor cannot reasonably meet the target dates

18 7. Accept or remediate non-compliant items Contingent Items 3 Types of CI s Contractual Contracts, SOW s, NDA s, BAA s; Incomplete; Out of date HR-Related Drug testing; Background checks; Credit checks Technical/Operations Typical IT/operations-related issues/findings/observations

19 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow 4. Triage risk High, Medium, & Low? 5. Start with an assessment & data collection instrument 6. Trust but Verify - Collect evidence 7. Accept or remediate non-compliant findings 8. Identify & assess critical, downstream vendors/subcontractors

20 8. Identify & assess critical, downstream vendors/subcontractors Down Stream Vendors/Subcontractors If you have a contract with them See if you ve already assessed them; if not then assess them! Request the same documentation as if they were a primary vendor If you don t have a contract with them Work with the primary vendor to obtain documentation Have the primary vendor set up a call to see what the DSV/subcon is willing to provide Use the same assessor if possible (they know the scope of work)!

21 8. Identify & assess critical, downstream vendors/subcontractors Determine the risk of these downstream vendors High, Medium, Low Seek third party attestations and other evidence regarding vendor s high risk vendors. SSAE-16, AUP, ISO 27001/2, PCI cert, etc. Review attestations & make a decision Make sure that your contract contains relevant terms

22 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow 4. Triage risk High, Medium, & Low? 5. Start with an assessment & data collection instrument 6. Trust but Verify - Collect evidence 7. Accept or remediate non-compliant findings 8. Identify & assess critical, downstream vendors/subcontractors 9. Determine if/when an on-site review is necessary

23 9. Determine if/when an onsite review is necessary Have the Primary vendor identify its vendors that: Will process, have access to or potential access to, transport, store, protected data Are in another country Determine how the vendor assesses, contracts with, and monitors these vendors You might have to do some work here Conference call interview, other Q & As, Determine if your staff or External Assessors will be needed!

24 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow 4. Triage risk High, Medium, & Low? 5. Start with an assessment & data collection instrument 6. Trust but Verify - Collect evidence 7. Accept or remediate non-compliant findings 8. Identify & assess critical, downstream vendors/subcontractors 9. Determine if/when an on-site review is indicated 10. Determine when a reassessment should be performed

25 10. Determine when a reassessment should be performed VAP Phase 4: Re-assessment Start planning by determining what criteria? Based on type of data (PCI, PHI, etc.)? Suggestions include: PCI = Annual PHI, Sensitive PII = Annual Non-sensitive PII, Strategic, other proprietary =??? Based on the geographic location? Onshore Offshore Offshore but with safe harbor agreements Based via scoring system? Risk Rating SIG Other GRC tool In house tool Combination of the above?

26 Top 10 Tips But wait there s more!

27 Top 10 Tips 1. One size doesn t fit all and it isn t free 2. Determine what data is in-scope for assessment 3. Accurately & thoroughly describe how the data will flow 4. Triage risk High, Medium, & Low? 5. Start with an assessment & data collection instrument 6. Trust but Verify - Collect evidence 7. Accept or remediate non-compliant findings 8. Identify & assess critical, downstream vendors/subcontractors 9. Determine if/when an on-site review is indicated 10. Determine when a reassessment should be performed and 11. Retain all assessment data, decisions, & records

28 11. Retain all assessment data, decisions and records Why? You are going to need them later! Regulatory, internal or other audit Something goes wrong (e.g., negative assessment) Reassessment How? GRC system, SharePoint, or some other centralized system. Back It Up (Murphy s Law!)

29 Top 10 Tips And if you call right now!!!

30 BONUS #1 Manage Your External Assessors They are an extension of your VAP team and should be treated as such Discuss their progress at least weekly Ensure they pull you in when the assessment begins to look bad - no surprises! Participate in closing meetings for key/offshore vendors Make sure vendors will accept their NDA s Be prepared for the legal departments to red-line the document! Be prepared to adjust start/end dates

31 BONUS #2 Use Operational Metrics VRB status monitoring Assessments assigned to assessors Internal/external assessments open Pre-assessment review Stage gates monitoring Assessor kickoff How long it takes to get the questionnaire back How long it takes to resolve AUP items (questions, documentation) Assessments in management review Contingencies due in the past 30/60/90/>120 Days

32 Thank You! & Questions?

33 For More Information (412) (617) Resources FAQs and tips for getting started Case studies Enterprise Cloud Computing Guide Detailed comparisons with regulations and international standards (HIPAA/HITECH, PCI, ISO, COBIT, NIST) Members Partners HIPAA HITECH PCI