Effectively Managing Vendor Risk

For those who manage information and technology, it's understandable that security assessments and questionnaires aren't particularly enjoyable activities. That statement is probably even more true when the assessment is being conducted between two organizations to simply prove business partners are all doing their part. Nevertheless, it's a fact of life in today's business world—where the perception of security is almost as important as the ability to actually secure information. (For more on vendor management, check out our resource center.)

Perhaps lost in all the excitement of increasingly complex technologies, concepts and regulations is the fact that the goal is still to simply assess a situation for risk. The moral of this story? There are a few:

• First, assessments are somewhat tedious even for those of us who create them, so know that you aren't alone.
• Second, there are good people and organizations out there trying to make the process better. Seek them out and do what you can to support them.
• Third, be patient. Security technology is finally expanding more into the realm of CSOs, risk officers and security auditors—which will improve numerous security practices that have been sorely lacking automation and efficiency.

Jeff Jenkins, CISSP, CISA, CISM, is vice president of Information Security Governance & Compliance for The First American Corporation. In his current role he is responsible for helping build and maintain all aspects of the corporation's information security program with a focus on managing the company's information security risk management and compliance efforts.