Questionnaires are a vital part of understanding how your vendors manage cybersecurity risk; they’ll help you understand the investments your vendors have made for positive risk outcomes across people, processes, and technology. They’re especially useful because, frankly, there are some questions you can’t get answers to unless you ask.
Yet as valuable as questionnaires are for assessing third-party risk, they have shortcomings. Here are best practices that can enhance your third-party risk program and get the most value from your vendor questionnaire process.
Challenge #1: Longer questionnaires mean greater costs.
The length of a questionnaire has financial implications. For example, according to a study by RiskRecon, each additional security assessment question can cost anywhere from $11.62 to $34 — that’s a huge range. (The range is due to economies of scale related to asking questions. The more questions you ask, the lower the cost to add an additional question to the questionnaire.) Add another $10,000 if you conduct an on-site visit. Long…
