Step 1: Review and identify
Review your selected Portfolio and identify which organizations have a lower score (C, D, F). These organizations have a higher relative likelihood of breach when compared to organizations with a higher score (A, B). These organizations are lowering your average Portfolio score and require attention.
Step 2: Communicate and set expectations
Once identified, collaborate with these organizations and communicate your expectations.
If an organization is inactive, you can easily invite them to improve their grade by utilizing SecurityScorecard’s in-platform invitation workflow.
With this workflow, you will be able to add contact information, create a personalized email message or use a template, co-brand by adding your logo, and add grade expectations with a time frame. For example, in your outreach, you can include an expectation to raise the grade to a B within 60 days.
If the organization is active, you can easily contact the company and begin collaborating. If you don’t have the right contact information, you can use the organization’s designated contacts.
Learn about inviting companies.
Learn about managing your contacts.
Step 3: Collaborate
While it is important to set expectations, it’s also important to collaborate with your third parties whose grades should improve.
With an Action Plan, you can either generate an automated plan or create a plan customized to the vendor based on your needs. Business relationships require the same level of communication as personal ones. Action plan help you can communicate better with your third- and fourth-party business partners. Giving them insight into the security issues that matter so you can foster a stronger, more secure working relationship.
Learn about using Action plans.
Step 4: Ensure compliance
We see that most organizations want to have greater influence over their vendor’s continuous security management — they want vendors to be proactive in monitoring and improving their Scorecard issues and overall grade. Customers appreciate that Scorecard provides an independent, objective, and consistent standard for evaluating security posture.
One of the most effective approaches to influence vendors is through contractual requirements. While the benefits of establishing a minimum standard are easy to understand—coordination, motivation, no grey area— implementing a program can be challenging.
Learn about using the Compliance tool.
Step 5: Automate continuous monitoring
To help ensure that your average Portfolio score stays up, it is important to continuously monitor the organization’s in a Portfolio. To make this process more efficient so that your team can focus on other important activities, utilize Rule Builder. Rule Builder enables teams to automate key workflows that trigger based on various changes in the Ratings platform.
Create the following Rule to help continuously monitor your Portfolio:
- Event: Grade Drops Below B
- For: Select a Portfolio
- Action: Send an Alert