These days, modern companies have a huge network of vendors, suppliers, contractors, technology providers and external service partners. While these connections can help organizations become more efficient and save money, they can also introduce a host of cyber security and compliance challenges.
A vendor may also have access to private customer information, internal systems, financial information, or vital business infrastructure. If this vendor has a data leak, doesn't have proper security measures, or even commits fraud, it can easily impact your organization.
What is Know Your Vendor?
Know Your Vendor (KYV) is a series of identification, verification and evaluation of third party businesses prior to entering or maintaining a commercial relationship with them.
This is usually done by examining data on a vendor's:
- Business identity and registration.
- Ownership and management
- Financial standing
- Regulatory status
- Reputation
- Compliance history
- Cybersecurity controls
- Data protection practices
- Risk of sanctions or inclusion on a watchlist
The goal is to find out if a vendor is trustworthy, legitimate, and can satisfy your organization's security and compliance needs.
While Know Your Vendor is related to compliance and risk management, it is also a critical component of cybersecurity. An inadequately evaluated vendor may also present an attack vector for cybercriminals, and create third party security risks for your organization.
Why is Know Your Vendor (KYV) important to Cybersecurity?
Third party relationships are becoming a common victim of cybercriminals. Rather than targeting a well-protected organization, attackers can take advantage of a less secure or smaller vendor that has access to an organization's systems or information.
For instance, a software company might have access to company information and an IT contractor might have privileged access to internal systems. The relationship could make it possible for an attacker to break into the larger organization if either provider lacks proper security controls.
Businesses can reduce these risks by having a robust Know Your Vendor process that allows them to discover these risks before they turn into a serious security issue.
1. Minimizes Third Party Cybersecurity Risk
Not all vendors have the same level of cyber security. Some may use advanced security software, while others might not implement basic security measures like multi-factor authentication, encryption, or employee security training.
Vendor assessments can be used to decide if a third party has the proper security measures. This enables companies to determine if there are high-risk vendors and put in place extra safeguards if needed.
2. Safeguards Vulnerable Business Data
Vendors deal with confidential information such as customer records, employee information, financial information, intellectual property, and business documents.
A vendor's breach could lead to exposure or misuse of this information. Vendor due diligence is used to gain insight into the information that a vendor will have access to and to determine if the vendor has adequate controls to safeguard the information.
Vendor assessments can also help organizations decide if a vendor's data handling practices adhere to internal security policies and applicable privacy requirements.
3. Enables the practice of Better Vendor Risk Management.
To manage vendor risks effectively, organizations need to be aware of and continually monitor risks from third party relationships.
A vendor's risk profile can change over time. For instance, a business can suffer a data breach, undergo a change of ownership, be subject to a regulatory penalty or start using new subcontractors.
Know Your Vendor should not be a one-off exercise, for this reason. Vendors should be reviewed periodically according to risk and the sensitivity of the services being provided.
Know Your Supplier vs. Know Your Vendor
Know your supplier' and 'Know Your Vendor' are sometimes used interchangeably, however, they may be applied slightly differently.
Generally, “Know Your Vendor” deals with third parties that supply products or services to an organization. Know Your Supplier may focus more on companies within the supply chain, such as manufacturers, distributors and raw-material suppliers.
Both methods play a significant part in cyber security.
A malicious supplier might end up providing malware or fake parts to a business's supply chain. Likewise, a vendor that has poor cybersecurity may be able to compromise sensitive information or develop vulnerabilities in the connected systems.
So, the assessment of the vendors and suppliers must be done based on the risk they bring in to the business.
The Vendor Due Diligence Process.
One of the most important aspects of a robust third-party risk program is vendor due diligence. It is the process of gathering and analyzing pertinent data on a vendor prior to a business relationship.
Due diligence can vary from vendor to vendor and industry to industry and may encompass:
- Business registration verification
- Checks of ownership and management.
- Financial risk assessment
- Litigation and regulatory checks
- Sanctions and watchlist screening
- Adverse media checks
- Cybersecurity assessments
- Data privacy reviews
- Information security certifications
- Business continuity evaluations
The level of due diligence should be commensurate with the risks of the vendor. A company that provides office supplies may only need basic verification, whereas a cloud service provider with sensitive customer information may need a much more detailed evaluation.
Understand how screening vendors can help identify risk.
Vendor screening helps businesses explore the third parties before forming or continuing a business relationship.
A screening process can help uncover possible issues like:
- Misrepresentation in business information and fraudulent information.
- Hidden ownership structures
- Sanctions exposure
- Regulatory violations
- Negative media coverage
- Financial instability
- Previous cybersecurity incidents
- Reputational concerns
Vendor screening services can help organizations conduct these checks in an efficient manner, especially when dealing with numerous vendors from various countries.
Use of automated screening solutions can also help to standardize the vendor onboarding process and track third parties during the relationship.
What to look for when screening vendors.
A thorough vendor screening process should include business and cybersecurity risks.
Business Identity
Organizations should ensure that the vendor is a registered business first. This may include business addresses, ownership and company registration information.
Ownership and Beneficial Owners
It is important to know who the real owner or the real control of the vendor is, to know hidden risks. Businesses should be mindful of the potential compliance, fraud and reputational issues that may arise from the ownership structure of the vendor.
Cybersecurity Practices
Organizations need to evaluate vendors' security of systems and data. This can include examining security policies, access controls, encryption, incident response, and applicable security certificates, depending on the relationship.
Regulatory and Sanctions Exposure
Companies should check if vendors or personnel affiliated with the vendors are listed on any relevant sanctions lists or watchlists. It is especially crucial for companies that do business in multiple countries.
Reputation and Adverse Media
Negative news reports can uncover risks that may not be apparent through the normal business verification processes. Businesses should determine if the vendor has been involved in any fraud, financial crime, data breach, or other serious issues.
How to develop an effective Know Your Vendor program
A successful Know Your Vendor program should include initial verification, risk assessment and continuous monitoring.
There is a structured approach that businesses can follow:
- Determine the vendor: Gather general company and contact details.
- Check the business: Ensure that the business is in operation and legitimate.
- Assess risk: Look at geographic location, industry, services, data access, and other risk factors.
- Do proper business, compliance and cybersecurity due diligence.
- Implement risk-based controls: Implement more stringent requirements for high risk vendors.
- Monitor on an ongoing basis: Re-evaluate vendors if circumstances change or at periodic intervals.
This method enables companies to go beyond the mere onboarding of vendors and build a more proactive approach to third-party risk.
The Future of Vendor Risk Management.
Third-party risks are likely to be a growing concern as businesses rely on SaaS providers, outsourced services, and international supply chains.
Cybersecurity teams need to be closely aligned with procurement, compliance, legal and risk teams to develop a holistic strategy to third-party risk.
Technology can also help with this process. Automated vendor screening services can assist organizations to validate businesses, detect risk factors and continue monitoring in large volumes. These tools can be used in conjunction with human review and risk-based decision making to improve third-party risk management.
Answering the most common inquiries on Know Your Vendor.
What is Know Your Vendor?
Know Your Vendor (KYV) is a process used by businesses to identify, verify, and evaluate third-party vendors prior to and during a commercial relationship. It is useful to organizations to have an understanding of business, compliance, cybersecurity and reputational risk.
Why is it important to know your vendor for cyber security?
Know Your Vendor assists organisations in determining whether their vendors are likely to have inadequate cyber security controls or access to sensitive systems and data. If these risks can be assessed, then exposure to third party breaches and supply chain attacks can be minimized.
What is vendor due diligence?
Due diligence conducted on a vendor to determine and assess the identity, ownership, reputation, compliance, financial condition, and security practices of the vendor prior to entering into or maintaining a business relationship.
What's the difference between vendor screening and vendor due diligence?
The normal practice of screening vendors includes a vendor check of databases, corporate records, sanctions lists, watchlists and adverse media sources. Vendor due diligence is more comprehensive and could involve more detailed financial, operational, compliance and cyber security risk analysis.
What is the frequency of screening for vendors?
The frequency will vary based on the vendor's risk level. Continuous or frequent monitoring might be needed for high risk vendors, and periodic or periodic when significant changes are made for lower risk vendors.
Comments