VRM programs can use SecurityScorecard to help manage and prioritize risk assessments of their third parties. This can be done by leveraging the platforms portfolio view, through the vendor invite function, and by distributing the reports among stakeholders.
All of these features along with others, such as drilling down into issue types for remediation, can be explored from the home screen. If you require specific guidance, please contact your customer success representative. SecurityScorecard’s ability to deliver fine-grain issues can support conversations among peer IT staff members when a specific high priority concern is surfaced by the SecurityScorecard solution.
Use cases
SecurityScorecard provides high value in its ability to help drive risk management conversations between:
-
C-Level to C-Level peers at collaborating companies – using Overall Risk Management Scorecards – C-level, risk and compliance management staff can quickly understand an overall score of partner cybersecurity health to help drive top-level cybersecurity concerns with C-Level peers at partner companies
-
Manager to Manager peers at collaborating companies – using Factor Level Risk Management Scorecards - Risk and compliance management staff can quickly understand risk management deficiencies across ten risk management areas of concern help drive conversations with peer managers at partner companies
-
Staff to Staff peers at collaborating companies - Using Detailed Security Finding Reports – IT operational and security staff can quickly understand over 77 fine-grain risk management concerns (i.e., SecurityScorecard Issues and Findings) to assist in notifying specific high priority risk concerns with partner companies
-
C-Level to Managers or Subordinate Staff within a single company– Using SecurityScorecard – Internal teams can use SecurityScorecard to understand, prioritize, and communicate internal efforts to improve the organization’s cybersecurity posture
-
Many Other Cross-Organization Relationships – Using SecurityScorecard – Multiple staff spanning risk, IT Security, Compliance and other departments can collaborate to understand and prioritize information risk projects within the organization and across partner lines
Best practices
To best leverage the value of SecurityScorecard for Risk Management organizations should:
-
Map out Your Risk Ecosystem within SecurityScorecard – include in your Partner Portfolio all companies that are currently a partner, might become a partner, or any other business (e.g., competitors) that have implications of risk to your business; Vendors can be added to a portfolio:
-
one at a time
-
or in bulk
-
-
Enable appropriate staff members to have access to SecurityScorecard; Users can adjust their partner portfolios to align with their individual role and responsibilities
-
Encourage appropriate staff members to utilize SecurityScorecard as part of their job-related risk management roles and responsibilities, both within the organization and across partner organizational lines
-
When appropriate invite partner companies to join SecurityScorecard
-
When appropriate encourage staff members to collaborate with partner companies on findings related to their risk management roles and responsibilities