Risk is a factor that businesses have always had to reckon with. It's an inescapable reality. Like matter or energy, risk cannot be completely eliminated. You can manage it through preparation, mitigation, or avoidance. But these efforts only modify probabilities; the risk factor is never zero. 

In the digital age, however, few aspects of business carry as dynamic a risk/reward ratio as the digital systems we use. The same technology that makes day-to-day business possible presents some of the biggest risk factors.

In light of this, what can organizations do to avoid and prevent these risks from becoming a reality? And what can be done to extend those protections to a third party included in the process?

For many organizations, effective threat management starts with security questionnaires.

An Introduction to Third-Party Vendor Security Questionnaires

Balancing prudence and audacity in business can be difficult. It's even harder when risk factors are variables rather than known quantities.

That's why risk management starts with taking stock of possible outcomes and identifying the factors that significantly impact outcome probabilities. This process often starts with a security questionnaire when vetting third-party technology vendors.

So, what are SIG questionnaires? Well, they function as a cross between something like a job application and something like a medical history survey. They act as a vendor risk assessment allowing third parties to illustrate their capacity to ensure data privacy, maintain regulatory compliance, and protect network security on behalf of the client.

Used successfully, a security questionnaire will help an organization more easily separate worthwhile vendor candidates from problematic ones. In addition, it will point to predictors of success and reliability and highlight information security "health concerns." This allows organizations to make informed decisions before verifying and trusting a service provider. 

The SIG and other Security Questionnaire Standards in the Market

Of course, when screening for predictors of success or failure in cybersecurity or elsewhere, the screening process is only as effective as the questionnaires used in that process. And without a common baseline to reference, organizations can't compare notes with each other, meaning the whole process repeats ad nauseam with each new client-vendor relationship. 

In other words, standardization is needed to facilitate any real methods for scaling these processes effectively. That's where the SIG comes in, along with other questionnaire standards.

Risk management concerns vary from industry to industry and even from organization to organization, so it's no surprise that finding a universal vendor assessment tool has been difficult. For one, cybersecurity and InfoSec are umbrella terms that can cover various aspects of data privacy, network security, and compliance of industry standards, depending on the business in question. 

Further still, some brands need to account for additional categories of risk concerns when outsourcing (such as supply chains or operations, for example). As a result, the current market offers multiple questionnaire standards, rather than a single, monolithic format. 

By way of example, a few of these include:

  • CAIQ
  • VSAQ
  • HECVAT
  • And, most relevant here, the SIG

Despite a fair amount of overlap in purpose and function from one standard to the next, each has a range of intended use cases and optimal applications. Consequently, no single standard currently available can cover every need or circumstance. 

Using the SIG and other security questionnaires can improve enterprise risk management and cyber security outcomes, especially when strategically deployed.

What Is the SIG?

The SIG (an acronym of Standardized Information Gathering) is the questionnaire standard developed by Shared Assessments, a third party risk management organization. The SIG Questionnaire is their flagship offering, but they also provide a widely recognized risk certification for third party vendors, known as the CTPRP.

The SIG questionnaire is an impressive tool, and the questions "span 19 risk domains." Primary areas of focus and assessment for the questionnaire include "cybersecurity, IT, privacy, data governance and business resiliency." 

In other words, the SIG is the go-to standard for client-vendor relationships that involve or affect processes such as:

  • Transmission or storage of data
  • Acquisition or disposition of IT assets
  • Management, migration, or maintenance of digital systems
  • Continuity of business operations (particularly those impacted by network downtime and other IT concerns)

How the SIG Can Be Implemented

The Shared Assessments program lists two primary use cases for their questionnaire standard. First, a client can administer the SIG core questionnaire to vendor candidates as part of their selection process. Or conversely, a vendor may use the SIG proactively, eliminating the need to fill out this or another proprietary questionnaire standard when pursuing a potential client.

In either scenario, a shared assessment offers a proactive solution for vendor risk management. the vendor answers each question seeking to prove their trustworthiness. Right-of-boom liability (e.g., for a user data leak or a HIPAA violation in the United States) is almost entirely in the client's hands, so while risks and security issues from the vendor threaten the client, the same is not typically true of the reverse. 

Most legal governing bodies place the burden of due diligence on the client in these scenarios, and cybersecurity risks especially have been on the rise in the last two decades. This leaves clients expecting vendors to prove their rectitude and resilience in a nearly zero-trust environment. 

Does the SIG Protect My Organization from Third-Party Risk?

While the SIG is a robust screening tool and can inform many important decisions regarding third party relationships, its effectiveness depends heavily on its implementation. Even then, it has limits. 

A well-screened vendor will be more likely to provide services without increasing risk factors. A "passing grade" does not, however, guarantee the fidelity of the vendor. It also doesn't fully predict the future behaviors of that vendor or their staff. 

Even more importantly, it doesn't preclude the client from falling short of achieving enterprise risk management goals internally. 

Third-party security diligence is critical to cyber risk management and mitigation efforts, and a screening questionnaire—no matter how thorough—is merely the first step in that journey. No questionnaire, the SIG or otherwise, is a fire-and-forget solution.

Proactive security efforts should also be applied internally, as oversights and negligence on the client side will be just as damaging as if they had come from a third party vendor in the process. In either case, liability for any breach or violation will fall to the client. 

How RiskRecon Can Help

While using a questionnaire such as the SIG to inventory and identify risk (and screen out vendor candidates beyond acceptable thresholds) is a good start, little will be gained if that new information isn't properly acted on. 

A vendor risk assessment will highlight red flags and enable clients to choose the lowest-risk vendor option. Unfortunately, though, even once risks are evaluated and measured, many organizations struggle to know how to manage third party cyber risk. Without taking proactive mitigation steps, organizations are left well below thresholds of acceptable risk and levels of due diligence.

For any team facing challenges such as this, know that there are risk professionals that can help you navigate the complex field of threat management and third party risk management. You likely already rely on cyber security solutions for internal risk factors. Now, you can depend on the same reliability when dealing with vendor risk management.

RiskRecon can empower your team and strengthen your information security with an automated vendor assessment tailored to your organization's unique circumstances and risk appetites. We can also provide guidance regarding mitigation and management strategies to prevent losses, prepare for rapid remediation, and more. 

As former International Space Station Commander Chris Hadfield once said, "No astronaut launches for space with their fingers crossed. That's not how we deal with risk."

If you're ready to stop crossing your fingers, schedule a RiskRecon demo to learn how simple cyber risk management can be.