Vendors that handle sensitive data, connect to critical systems, or support important operations can extend your exposure. We help inventory those relationships, classify them by risk, and set due diligence and monitoring to match the service, data, access, business impact, and obligations that apply.
Deliverables are yours to keep and are written so your team can maintain them after the engagement ends.
Every vendor should be inventoried, but the depth of review should match the risk. Vendors that store your sensitive data, connect to your network, or support critical operations get the most scrutiny. Low-risk vendors may need little more than a contract clause.
It is valuable evidence, but it has to be read. We check the report’s scope, period, exceptions, and complementary user entity controls, which are the responsibilities the vendor expects you to handle.
Document the risk decision. Options include relying on independent attestations, adding contract terms, limiting the data you share, or choosing an alternative. What matters is that the decision is deliberate and recorded.
We discuss what is driving the need and when it is due.
You receive a scope, deliverables, timeline, and fee.
We send a document request and schedule interviews with your team.
Risk analysis based on NIST SP 800-30 that ends in a prioritized remediation plan.
Senior security leadership to set priorities, facilitate risk reviews, and report to executives.
Preparation for HIPAA, ISO/IEC 27001, SOC 2, GLBA, and FFIEC reviews.
Tell us what is driving the need and when it is due. We will tell you plainly what it would take.
