Managing (and Surviving) Vendor Security Questionnaires

Posted July 30, 2019

It’s Friday afternoon and a potential client has sent you a vendor security questionnaire longer than the last Harry Potter book. Ugh. And it’s probably not the first one you’ve gotten this week.

You’ve seen breach after breach in the news. These potential clients have seen them too, and they want to keep their own names out of the headlines. Businesses aren’t just strengthening their own cybersecurity programs; they’re making sure that their partners are also making an effort.

At GreyCastle Security, we talk with organizations every day that are stunned by the volume of vendor questionnaires they’re receiving. For some of these organizations, that first questionnaire was also the first time they started thinking seriously about their cybersecurity programs. Others have been dealing with vendor questionnaires for years but haven’t found a good solution for keeping their heads above water. “Overwhelmed” is putting it lightly.

Whenever you see a new questionnaire appear in your inbox, you probably ask yourself, “Is there anything I can do to get some relief?”

Thankfully, the answer is yes. Here are some tips and best practices for making vendor security questionnaires more manageable:

Formalize your program.

Working from a framework will help streamline your program – and the answers you give on vendor security questionnaires. A framework (such as NIST) offers organizations a more efficient methodology for managing risk as well as the opportunity to pinpoint existing policies and processes that can be improved and areas where a new process can be introduced. This doesn’t just help you communicate better about cybersecurity internally; it also gives you a common language to speak with potential clients. When you combine your new understanding of your risks with an implementation plan, you can begin to prioritize risk in a more cost-effective way and set expectations both internally and externally. This prioritization and implementation plan can also be leveraged as evidence for your program as you fill out vendor questionnaires. As you probably already know, many vendor security questionnaires ask the same questions (sometimes even in the same questionnaire, just in a different way). A documented framework will give you the ability to provide consistent, repeatable answers.

Because it is outcome-driven, a framework is also able to scale right along with your business. Whether you are a startup with a limited cybersecurity budget or a Fortune 500 company with deep pockets, the framework empowers you to approach outcomes in ways that are practical and unique to your business. This type of flexibility also extends to the maturity of your program – with a framework, you can build a program from the ground up just as easily as you can improve matured controls. As you work on and formally document your program, you are also enhancing your ability to successfully answer vendor security questionnaires.

Align your program with business goals.

A cybersecurity program isn’t just something that secures your assets; the program itself is an asset. With that in mind, how is your program incorporated into your enterprise strategy?

When you view cybersecurity as only a siloed function within IT, you miss out on key opportunities, such as using your program as a unique differentiator from the competition. In today’s complex digital landscape, it’s practically a requirement to view your cybersecurity program from a more nuanced angle. It is not a technology problem. Cybersecurity touches every area of your business – and vendor security questionnaires reflect this.

Vendor questionnaires tend to be based on some kind of standard, which means you will likely find questions related to human resources, finance, change management, incident response, security, technology, and even education and awareness. These are all areas that your cybersecurity program will touch on a daily basis, so you need to be able to speak to them on vendor questionnaires. Oftentimes, it falls upon one person to act as the coordinator and gather the relevant information from different business units.

Daniel Gibson, a Security Strategist at GreyCastle Security, recommends a proactive approach to make this task easier. The coordinator should first let the applicable departments know that he will have questions for them and then identify a person within each business unit that can act as a go-to person for questions, even if only on a temporary basis. This will streamline the entire information gathering process.

In many cases, vendor questionnaires are automatically scored, so too many “no” answers or gaps can give a negative result, which might mean losing out on big business. This is why assigning a coordinator to the process is not optional. You need someone willing to become an expert in understanding the questions on vendor security questionnaires and reach out to the relevant business units. It’s vital to have a coordinator that understands internal processes, knows how they impact security, and can explain this in an articulate way.

Build a common response repository.

As you fill out more and more vendor security questionnaires, you will see there are many similarities between them. With this in mind, Daniel Gibson also suggests that you build a common response repository.

“If the questions are just yes or no, that’s great,” he says, “but oftentimes when you answer no, you have to put a comment in the questionnaire. Or, if it’s a yes, you need to include an explanation because there’s something unique about your policy or how you perform a task. The more that you build out these comments, the easier it’s going to be for one person to understand the common responses from different business units and fill those in.”

Maintaining this repository of common responses will make the coordinator’s job easier and allow them to respond to questionnaires more efficiently. Knowing and having fast access to this information will help you communicate that you take information security seriously, which will in turn help you grow the business.

Pursue certification.

In the case of vendor questionnaires, certification is third party validation that your security program is sound and that your business operates with a security mindset. If you choose to pursue ISO 27001 certification or SOC 2 report readiness, you will be in a position to prove to potential clients that you are dedicated to securely managing data.

ISO 27001 is an international, auditable standard for an Information Security Management System (ISMS). Certification demonstrates that your organization manages the security risks of the data you hold and has put controls in place to mitigate damage.
A “clean” SOC 2 report helps organizations build trust with clients regarding their service delivery processes and controls. The report assesses an organization’s systems to ensure security, availability, processing integrity, confidentiality, and privacy.

You know from the stack of them on your desk that vendor security questionnaires aren’t going anywhere. And, much like Tribbles from Star Trek, they are likely going to multiply faster than you can handle. This is why it’s critical to put a process in place today that will help your team complete these questionnaires effectively and efficiently. It will help your security team reduce stress and help your business development team increase sales.