Supplier Code Of Conduct Development

Most vendor failures don’t happen at onboarding. They happen in the quiet months when no one is looking. A supplier who passed every check in January could be insolvent by March. A “secure” IT partner today could suffer a breach tomorrow. And if your process only checks once a year, you will not know until it is too late. That is why continuous compliance is becoming the new standard. It means tracking a vendor’s financial, cyber, and reputational health in real time — all year, every year. Here is a 5 step framework you can apply now: 1️⃣ Define your critical vendor health indicators → financial stability, cyber posture, compliance status 2️⃣ Embed these checks into onboarding workflows 3️⃣ Automate ongoing screening for: → OFAC lists and regulatory watchlists → Company registry changes → Adverse media alerts 4️⃣ Monitor spend for unusual patterns or spikes 5️⃣ Review performance and risk status quarterly with stakeholders I have built this two pager so you can drop this straight into your own process or improve your current processes. Save this post and comment COMPLY if you want it.

Third-Party Risk Management (TPRM) in #GRC— As organizations increasingly rely on vendors, contractors, and service providers, third-party risk management (TPRM) has become a critical part of GRC programs. Poor vendor management can expose companies to data breaches, regulatory penalties, and operational disruptions. 1. TPRM • Regulatory Compliance: Frameworks like PCI DSS, GDPR, and ISO 27001 require organizations to assess and monitor third-party risks. • Vendors often manage critical business functions, so disruptions in their processes directly impact your operations. • A vendor breach could tarnish your brand and lead to legal or financial penalties. 2. TPRM Lifecycle • Assess vendor security practices before engagement (e.g., security questionnaires, contract reviews). • Identify risks specific to the vendor (e.g., data handling practices, access to systems). • Continuously monitor vendor performance and compliance through audits, reporting, and SLAs. • Ensure proper data disposal and de-provisioning of access after vendor offboarding. 3. Frameworks / best practices • NIST SP 800-161 focuses on supply chain risk management for federal systems. • ISO 27001/27036 provides guidance on third-party security requirements. • Shared Assessments Program offers standardized tools like SIG (Standardized Information Gathering) for vendor assessments. 4. Key Tools • Vendor management platforms like OneTrust, BitSight, or Prevalent help automate risk assessments and ongoing monitoring. • Use third-party security ratings to assess vendor vulnerabilities in real time. 5. Building strong TPRM programs • Establish clear policies and procedures for vendor risk management. • Conduct periodic risk assessments and ensure vendors comply with applicable regulations. • Collaborate with stakeholders across procurement, legal, IT, and compliance teams. TPRM integrates seamlessly into GRC.

The GRC Mindset | Post 15 Third-Party Risk: Trust, But Verify ……………………………………………………. This is my 15th post on GRC — a journey that’s grown with your comments, shares, and questions in my inbox. It’s become clear that GRC isn’t just a function. It’s a mindset every professional needs to develop. So from here on, I’m naming this evolving series “The GRC Mindset.” Keep reading, sharing, and most importantly — keep the feedback loop alive. That’s what’s kept the tempo going. ……………………………………………………. Remember SolarWinds? One software supplier’s compromise ended up infecting thousands of companies — including banks and government agencies. Cut 2 — the MOVEit breach. Attackers slipped through a vulnerability in a trusted file-transfer tool and ended up hitting hundreds of organizations worldwide. That’s third-party risk in action. Your security is only as strong as your weakest partner. What is Third-Party Risk? Every vendor, contractor, or SaaS provider connected to your systems expands your digital perimeter. And when they slip, the blast radius often reaches you. In 2024, over one-third of global data breaches originated from third-party compromises. Where GRC Comes In GRC is not just about protecting your own house — it’s about knowing who else has the keys. Before signing contracts, during operations, and even after — GRC ensures trust is verified, not assumed, and accountability stays clear. Here’s how 1️⃣ Due Diligence: Evaluate your vendors and classify them before onboarding. Use simple security questionnaires, review policies, and check certifications like PCI, ISO 27001 or SOC 2. Even a quick “show me your security practices” can reveal red flags early. 2️⃣ Contractual Protections: Bake security into contracts — include breach notification timelines, minimum control standards, and the right to audit. Paperwork won’t stop attacks, but it ensures accountability when they do. 3️⃣ Continuous Monitoring: Don’t file away the vendor review once they’re onboard. High-risk vendors — cloud, data processors, IT service providers need periodic reviews, not annual surprises. 4️⃣ Contingency Planning: Always ask, what if this vendor goes down? Concentration risk is real.  Keep backups, alternate providers, and a disconnect plan ready. When your vendor sneezes, you shouldn’t catch a cold. A Quick Real-World Lesson I once reviewed a small IT service provider during onboarding. Their team had no 2FA for admin accounts. We flagged it, helped them fix it — and probably prevented a breach before it happened. That’s the quiet power of third-party oversight: risk reduced before headlines appear. Bottom Line In today’s ecosystem, your security is only as strong as your partners’. Third-party risk management isn’t about mistrust — it’s about mindful trust. GRC’s role is to shine a light into the hidden corners of the supply chain — so you’re never blindsided by someone else’s mistake. #CyberSecurity #GRC #DigitalTrust #WhatsInIt4Me #UmaRamani

Third-party vendor due diligence isn't easy. So here is check for assessing vendors before entering into a contract: 1. Vendor Overview: Company Overview: Get the company’s name, address, contact details, website etc. References: Get customer introductions / references 2. Overall Compliance and Regulatory Regulatory Compliance: Ensure the vendor complies with relevant industry regulations and standards. Sanctions & Watchlists: Screen the vendor against global sanctions lists and watchlists. 3. Operational Capacity Service Level Agreements (SLAs): Get the vendor’s SLAs for service availability, response times etc. Tech stack: Know the vendor’s tech stack. Supply Chain & Sub processors: See below to check for dependencies. 4. Data Protection and Security DPA: Get the DPA to check the vendor's data processing activities Sub processors: Who are they using as sub processors and what are the data transfers? Security Measures: Does the vendor have security certificates, is data encrypted, what are the access controls etc. Get the audit certificates. Get a copy of the vendor's incident plan. Security Policies: Assess the vendor’s information security policies and practices. Business Continuity & Disaster Recovery Plans: Review the vendor’s contingency plans. 5. Risk Management Risk Assessment: Conduct a risk assessment specific to services you'll be using. 6. ESG & CSR & Code of Conduct Corporate Social Responsibility (CSR): Review the vendor’s CSR policies. Environmental Impact: Evaluate the vendor’s environmental practices and sustainability initiatives. Labor Practices: Check labor practices, incl. compliance with labor laws and ethical treatment of employees. Code of Conduct: Get a copy of the vendor's code of conduct. Make sure it aligns with your organization’s values. 7. Legal and Contract Contract Review: Do the contact review. Normally everyone is doing that - of course provided that the business remembers to include Legal in the process:) 8. Implementation & Exit Implementation: Get the vendor to send an implementation plan. They should know & be able to share one. It will ensure alignment. Exit: All contracts will come to an end at one point. Make sure you have a clear view and process for Data Return/Trasnfer/Destruction upon termination. 9. Documentation and Records Documentation: Save the documentation and store it so you can find it again. You'll need it for many reasons. 10. Approval Process: Make sure that the vendor is reviewed and approved by the relevant stakeholders. I said it wasn't easy 😅 And the list isn't even complete. It's like a treasure hunt - - What did I forget?

Risk Scenario 7: Weak Vendor Management 1. Identification of Risks: • Scenario: An organization partners with third-party vendors that handle personal data, but fails to adequately assess and monitor their data protection practices. This can lead to data breaches and non-compliance issues if the vendor’s security measures are insufficient. • Regulatory Requirements: Data protection laws like GDPR and PDPL require organizations to ensure that their vendors comply with relevant data protection standards. • Internal Audits: Audits often reveal insufficient oversight of vendor data protection practices, leading to potential risks. • Stakeholder Feedback: Concerns from stakeholders about third-party data handling practices underscore the need for stringent vendor management. 2. Assessment of Risks: • Likelihood: High, as many organizations rely on third-party vendors without fully understanding their data protection measures. • Impact: Severe, as a vendor’s poor data security practices can lead to significant data breaches, regulatory fines, and reputational damage. 3. Mitigation of Risks: • Vendor Assessment: Conduct thorough assessments of vendors’ data protection practices before entering into contracts. • Contractual Obligations: Include data protection clauses in contracts with vendors, ensuring they comply with all relevant data protection laws. • Ongoing Monitoring: Regularly monitor and audit vendors’ data protection practices to ensure continued compliance. • Employee Training: Train employees responsible for vendor management on how to assess and monitor vendor compliance with data protection requirements. 4. Recommendations: • Policy Updates: Update vendor management policies to include stringent data protection requirements. • Automated Tools: Use automated tools to monitor vendor compliance and manage vendor-related risks effectively. • Vendor Audits: Conduct regular audits of vendors to ensure they maintain adequate data protection standards. By addressing weak vendor management through identification, assessment, and mitigation, organizations can minimize the risks associated with third-party data handling, ensuring compliance with data protection laws and safeguarding personal data.

Your vendors can be the reason why you get hacked! A few years ago, a major company I know suffered a devastating data breach, but the attack didn’t start with them. It started with one of their vendors. A third-party service they relied on had weak security, giving hackers a way into their systems. And want was the result? Millions of customer records were exposed. This isn’t an isolated case. Target’s infamous 2013 data breach too started with an HVAC vendor. The SolarWinds hack started with a supply chain attack that compromised thousands of businesses worldwide. We should ask ourselves, why are third-party vendors a security risk? 1. Weak security policies – Many vendors don’t have strong cybersecurity measures in place. 2. Overly permissive access – Some vendors have access to sensitive systems they don’t need to complete their job. 3. Supply chain attacks – Hackers use vendors as a stepping stone to infiltrate larger companies. 4. Lack of regular security audits – Many businesses fail to monitor and enforce cybersecurity compliance for vendors. I won’t give you the problems without providing solutions. Here are the ways out: 1. Conduct security assessments – Before working with any vendor, check their security policies and compliance standards. 2. Limit vendor access: Only grant minimal necessary access to protect sensitive data. 3. Regularly audit vendor security: Monitor their security practices to ensure they stay compliant. 4. Use vendor contracts with security clauses: Ensure legal agreements hold vendors accountable for cybersecurity breaches. Your company’s security is only as strong as the weakest link in your network. Don’t let a vendor’s weak security become your biggest vulnerability. Are you confident your vendors are secure? Let’s discuss. #cybersecurity #thirdpartyrisk #dataprotection #riskmanagement #supplychainsecurity #infosec