Vendor and Service Provider Due Diligence

Many organizations feel they can trust their service providers. While that may be true, your organization should view your vendors and service providers as an extension of your operations, not separate entities.

If a weakness or failure at one of your service providers leads to a data breach or operational issue, your organization, employees, constituents, and other stakeholders may feel the impact — both immediately and long-term.

It’s imperative to establish strong vendor oversight procedures to ensure your vendors can continue to meet your needs and support the confidentiality, integrity, and availability of your data.

Simplifying the Due Diligence Process

The vendor and service provider due diligence process can be burdensome and time-consuming for many organizations. CapinTech can simplify the process by collecting, evaluating, and summarizing documentation of the controls your vendors have in place. Our experienced, dedicated specialists will:

Work with you to request key documentation from your service providers on your behalf.
Create concise but informative reports with relevant information and summaries your information technology and security departments can evaluate without the burden of document collection and review.
Provide executive summaries for your senior management and Board of Directors, who are often invested in your vendor and service provider relationships. These summaries can help your leaders oversee these relationships.

What Your Vendor Review Will Involve

Not every vendor relationship presents the same level of risk. And not every service provider has the same level of documentation and control. We will request a variety of documentation to gain insight into your service providers’ overall control framework and report on key areas so that your organization can make informed decisions about each relationship based on the unique risk it presents to you.

The types of information we request include, but are not limited to, the following:

Audited financial statements or a summary of financial condition, if financial statements are not released to the public
Security audit reports, penetration testing, or vulnerability scanning documentation
Business continuity planning documentation
Disaster recovery testing results and documentation
Identity theft program documentation (which may include a letter of exception)
Proof of insurance coverage, including cybersecurity considerations
Cyber threat prevention procedures
Incident response planning documentation
Identification of data stored outside the United States and documentation of enhanced data protection policies and measures for foreign storage arrangements
Vendor management oversight procedures for initial and ongoing due diligence
Compliance and licensing information
Customer complaint resolution and performance standards information

Depending on your industry, there may be additional evaluation requirements, such as obtaining examiner reports or other regulatory compliance documentation. If your organization needs evaluation in these areas, we will work with you to prepare the necessary request documentation.

Cyber threats change rapidly, so we review our procedures annually and tailor them accordingly. If there are significant breaches in your industry, we will periodically ask each vendor how they responded to and mitigated the threat.

Insight to Help You Manage Your Risk

Upon completion of your vendor review, we will provide summary reports and documentation supporting the review. You will receive:

Copies of all documentation provided by your service providers that was used in performing the evaluation
Detailed vendor reports that summarize the information reviewed and provide insight into each vendor’s health and control framework
An executive summary for your Board of Directors or other executive management teams
Guidelines and recommendations for next steps
Access to our team throughout the year for questions and guidance

Please contact us at [email protected] to learn more about how we can help your organization conduct and maintain effective vendor and service provider due diligence.

Additional Resources:
Why Your Organization Needs a Vendor Management Program
Recorded Webcast: The Criticality of Vendor Management and Due Diligence