Third-Party Assessments
During the performance of your third-party assessment, our list of questions include:
- Do they follow Security Standard (ie: SOC2, ISO, FedRAMP, etc)
- How are they integrating and what risks do they impose?
- What data is being processed, stored, or transmitted?
- What countries are involved in processing, storage, or transmission of data?
- Are they GDPR or CCPA compliant?
- Do they perform background checks and what kind?
Third-Party Assessments are essential for the management of vendors, partners, software, hardware, and tools employed for the research and development, design, acquisition, delivery, integration, and operations and maintenance of your product. They evaluate the risks of incorporating outside entities into your information system program and clarify their security posture. With this information, you will be able to perform a cost analysis and concisely decide what risks your entity is willing to accept.
Additionally, the new NIST 800-53 revision 5 has been updated to include third-party assessments and will be required by many other security standards, authorizations, and certifications in the near future. Please note that these standards include all current and future relationships.
As part of our process, we review their privacy policies, terms and conditions, and other documentation to ensure that you understand their security posture.
