How Cyber Risk Exchanges Are Reinventing Vendor Risk Assessments

BLOG 3 MINS | June 23, 2020
How the Vendorpedia Cyber Risk Exchange is Reinventing Vendor Risk Assessments

It’s true: modern vendor risk assessments are time-consuming. First, you need to build the assessment, then determine which version of the assessment to send, as well as which vendors need to complete it. From there, you need to identify the right respondents, answer any clarifying questions, review the risks, validate the assessment answers, and reassess the vendor each year.

But what if there was a different way?

In this post, we’ll explain how the Vendorpedia Cyber Risk Exchange can streamline your vendor risk assessment process.

5 Ways the Vendorpedia Cyber Risk Exchange Helps Streamline Vendor Risk Assessments

1) Access Completed Industry-Standard Assessments

The key aspect of a Cyber Risk Exchange is the “exchange” of assessments between the companies doing the assessing and the ones being assessed. By building a community of vendor risk assessments, the Cyber Risk Exchange can facilitate this transaction. Third parties make their completed standard-based assessments (ISO 27001, ISO 27701, NIST 800-53, CSA CAIQ, SIG Lite, and SIG Core) available for request through the exchange.

2) Offload Assessments to an Expert Assessment Team

If an assessment is not already completed and made accessible through the Cyber Risk Exchange, our team of Risk Assessment as a Service agents will “chase” the assessment for you. These Vendor Chasing Services™ offer reprieve for individuals overwhelmed with conducting vendor risk assessments. You choose the vendor and the assessment type, our team handles the rest. We work directly with the vendor to get the risk assessments back in a timely fashion.

3) Receive Risk and Gap Analysis Reports

Assessments shared through the exchange come with a report on the risks and gaps identified. Use this report, in combination with our Assessments & Due Diligence platform, to conduct risk treatment, lowering your residual risk levels to meet your risk appetite.

4) Order Assessment Validations Directly Through the Exchange

Half the battle with assessments is simply getting the vendor to complete the questionnaire, while the other half is reviewing and validating the answers. Through the Cyber Risk Exchange, you can order assessment validations to be carried out by the OneTrust Validation Partner Network.

5) Monitor Changes by Linking Vendors to Their Exchange Profiles

Within the Cyber Risk Exchange there are 60,000+ third parties, each with security and privacy profiles. These profiles include aggregated information from over 100+ data sources, including security and compliance certifications, which are updated daily. By linking the third parties in your inventory with their profiles in the Cyber Risk Exchange, you can maintain an evergreen vendor inventory and receive alerts when new risks arise (such as a certification expiration).

Want to see how the OneTrust Vendorpedia Cyber Risk Exchange can help you reduce the burden of vendor risk assessments? Request a demo today.