One of the most common questions we’re asked is how to incorporate continuous monitoring into a third-party risk management program. In part one of this two-part blog, we discussed beginning with the end state in mind to establish goals for your continuous monitoring program and suggested you jumpstart your program with a pilot. So once the pilot is complete, now what?
Like many organizations today, you have existing processes, tools and people laser-focused on analyzing periodic vendor security questionnaires, documentation, and on-site reviews. Moving to a continuous monitoring program can be daunting. Our advice: Don’t focus on where to start…think about where you want to end up. Begin with the end state in mind.