I am writing this post in middle of pandemic, when employees are working from home and organizations have been forced to hire third party vendors to do myriad of jobs ranging from print services to purchasing software to enable remote login for employees. This happened so quickly that not many companies had the time or capacity to take a risk based approach.
Irrespective what what kind of product a vendor provides, you always want to assess the risk profile of the vendor organization and the product that you are or will be using. Why is it important? It is important to know what would be the impact to your business if something were to happen to the Vendor tomorrow and you are no longer able to use the product or service from few hours to few days to permanently. How dependent your business operation is going to be on the vendor's business operation. If you don't know the risks, then you are inviting a lot of trouble that you can easily avoid by assessing the risk beforehand. If you know the inherent risks, then you can create backup plan in case the primary measure fails or decide not to do business with them. There might still be some residual risk that would remain even after the mitigating factors, and which is normal. The line of business then needs to decide whether they are willing to accept that risk. Residual risk would usually be minimal and a much better state to be in, instead of not knowing about any risks at all. You create options for the smooth operations of your business activity, which is a big responsibility your organization has given in your hands.
What factors must be considered?
Short answer is that there are a lot of factors and it depends your what kind of client organization are you representing. Risks are different for different type of organizations.
Questions to ask yourself:
- How large is my organization?
- How many employees do I have?
- Where are my offices located worldwide?
- Where are my employees located worldwide?
- Would we be sharing customer data? if yes, then what elements, how much volume?
- Is the vendor product going to affect a small portion of my business, or would it be enterprise-wide?
- Are we outsourcing a critical business activity that has very low appetite for downtime?
- Is my organization in an industry that is heavily regulated? e.g. Banks, Telecom
- Are there regulatory requirements that I need to meet?
- Most importantly, why are we outsourcing? why can we not do this activity inhouse
- What is my breakeven point if we do it inhouse?
- Is the vendor required due to an audit finding or a regulatory requirement?
- What is the financial impact if the service goes down?
- What is the reputational impact if the service goes down?
- Is this my core business to do what the vendor is doing?
Questions to ask Vendors
- Why type of solution are you offering? Is it a service, software, hardware, something else?
- Is there a cloud solution involved? If yes, whether it is private, public or hybrid cloud?
- What kind of system data would the vendor have access to? Confidential, Critical, Restricted, Internal, Public? volumes?
- What kind of customer data would the vendor have access to? Do they have access to PII? Do they have access to European, UK, APAC, US customers? Are they compliant with respective country's Privacy Laws such as PIPEDA, GDPR, HIPAA, COPPA?
- What kind of Employee data would they have access to? Ask the same compliance question
- Where is the data going to be stored?
- How would the data be transferred between the two organizations? Is it over a secure connection, FTP, private leased line?
- Where is their Data Center located?
- Where is their DR located? are they in the same seismic zone? same region different zones or different regions and different zones? What is the RTO, RPO?
- What is the committed SLA? Is it 99% or 99.9% or 99.99%? Each 9 increases significant investment that the vendor has to make in their infrastructure.
- How much time and money investment would it take to replace the vendor if needed?
- Have they conducted business ethically in past? This is in itself a very large subject that could include any type of unethical behavior such as bribing, tax evasion, manipulating accounts, money laundering, etc. the list is huge.
- Is the vendor going to have a direct impact on your financial statements? e.g. Auditors
- Would they have physical access to your technology assets?
- Is the vendor using a cloud solution? e.g. Private, Public or Hybrid? Where is the data hosted? is it with Public cloud providers such as Amazon or Azure?