Cybersecurity and Third-Party Risk

Chapter 5Onboarding Due Diligence

As part of Third‐Party Risk Management (TPRM), the first step in engaging the lifecycle of a vendor's due diligence is during intake. As a new vendor is identified by a business, it is required to perform an initial review of the vendor's risk domains. For the cybersecurity domain, this is generally performed via a remote questionnaire or during question and answer (Q&A) sessions. Initially, an intake questionnaire, known as an Intake Risk Questionnaire (IRQ), should be provided to assess the initial risk. This list of questions should be short and determine which risk domains are relevant and require due diligence.

Intake

During this part of the lifecycle of the vendor, a business has all the leverage. Once the contract is signed, good intentions aside, no one will want to renegotiate on stricter cybersecurity terms. Also, items discovered at this point in the process—security gaps, process concerns, lack of required certifications, and due diligence—are all best done before contracts are signed. In many cases, even if the vendor can't meet the security or other risk requirements at the time needed to initially, the remediation of those items can be listed within the contract with milestones tied to payments. These milestones require the cybersecurity teams to be actively engaged in the Intake process. See Figure 5.1. which illustrates that we are in the Onboarding phase.

Transparency is the approach needed for the intake; however, the process ...