Risk-Based Vendor Management Fundamentals

Agenda

Risk-Based, Cybersecurity-Focused Vendor Management and Why Organizations Need It

• The Cybersecurity Threat Landscape
• Understanding Cybersecurity Risks Posed by Third Parties, Vendors, Service Providers, and the Supply Chain
• The Potential Impact on Organizations
• Regulatory and Contractual Compliance Obligations

Assembling an Interdisciplinary Vendor Management Team

• Identifying Appropriate Stakeholders
• Identifying Team Responsibilities
• Creating or Updating a CybersecurityFocused Vendor Management Program
• Monitoring Internal Program Compliance
• Auditing ThirdParty Compliance
• Performing Vendor On and Offboarding
• Assuming Responsibility for Vendor Communications, Data Breach Response
• Identifying Appropriate Method of Performance Manual, Automated

Developing an Appropriate Risk-Based Vendor Management Program

• Creating a Third-Party, Vendor, and Service Provider Inventory
• Identifying Regulatory and Contractual Compliance Obligations
• Identifying Potential Risks to Data and Systems; Assign Risk Levels
• Creating Scalable Standards
• Creating Risk Assessment Questionnaire
• Developing Internal Policies and Procedures for Implementing, Reviewing, and Monitoring the Program

Performing Due Diligence

• Assessing and Evaluating Responses to Risk Assessment
• Conducting Onsite Audits
• Obtaining Required Certifications
• Validating Vendor Representations

Executing Vendor Contracts

• Drafting Contractual Obligations
• Addressing Reasonable Safeguards
• Allocating Risk
• Performing Internal Contract Management
• Reviewing and Updating Contracts as Necessary

Best Practices

• Maintaining Documentation of Risk Assessments and Supporting Documents
• Limiting Vendor Access to Data and Systems
• Implementing Internal Incident Response and Business Continuity Plans
• Segmenting Systems
• Monitoring Vendor's Cybersecurity Controls
• Training Internal Staff
• Minimizing Data Collection; Adhering to Appropriate Date Retention Schedules
• Assembling a Truly Interdisciplinary Team

Available Resources

Credits

Faculty

Mary T. Costigan

Jackson Lewis P.C.

• Member of the Jackson Lewis P.C. Privacy, Data and Cybersecurity Practice Group
• Advises multinational, national, and regional companies on emerging data privacy and cybersecurity issues including mandates, best practices, and preventive safeguards
• A certified information privacy professional with the International Association of Privacy Professionals and co-chair of the New Jersey chapter
• Writes and speaks frequently on a variety of data protection issues; she wrote the OneTrust DataGuidance “New Jersey – Data Protection Overview” and posts frequently to the Jackson Lewis Workplace Privacy Report blog
• Recent webinars and presentations include “Data Protection Update: Post-pandemic remote workers, trending laws and ransomware FAQs” for the New Jersey Association of Corporate Counsel, “Mitigating Risk by Managing Your Sensitive Data” for ARMA New Jersey, “Data Privacy” for L&E Global, and “The CCPA”, for Truyo Privacy Leaders Circle