The cybersecurity incidents that unfolded in the past two years have been unpredictable, to say the least. This past year, businesses suffered in ways previously unknown to many. Some of the biggest lessons that we learned in 2021 include prioritizing cybersecurity and monitoring your third parties frequently, ensuring that your vendors have adequate business continuity plans, monitoring your vendors’ financial health, staying informed about the regulatory environment, and outsourcing vendor risk management. 

The past year taught us many important lessons. In order to ensure better outcomes, it is prudent to work on the things we learned in the past year and improve vendor management success. Here are six vendor management success tips to help you in the new year. 

1. Team up with your information security team to review and update your existing third-party due diligence questionnaires. This is to make sure that they reflect on your company’s existing cyber risk environment. You must also ensure that your vendor management and information security teams develop a robust strategy to address any significant changes in cybersecurity or any threats that require specific third-party responses or action outside the annual risk review. 
2. Make sure that your annual risk reviews are updated and current and prioritize critical third parties. If you have been dealing with lapsed or late reviews, consider outsourcing any due diligence document collection. Send the reviewing responsibility to any external vendor management service firms. This is the most cost-effective option in most cases as opposed to adding staff. Moreover, it results in a shorter turnaround time than when using internal resources. 
3. Focus on your third parties’ business continuity and resiliency planning. Be sure to test your planning. This allows the third party to disclose any identified issues or gaps during this phase. Moreover, the third party will be able to provide you with a remediation plan to close the gaps. 
4. Analyze your third-party insurance requirements. Ensure that cyber insurance is a separate policy from general liability. Collaborate with your company’s legal team to review or update any required policy types or coverage amounts. Moreover, confirm that your organization’s third-party contracts include all requirements. 
5. Subscribe to any monitoring or risk alert services as they improve continuous third-party risk monitoring and make it easier to spot any declines in financial performance. 
6. Learn about any regulations that may affect your industry and any laws that govern third-party relationships. Common themes with almost all regulators include focusing on privacy, cybersecurity, and business operations resiliency. 

No one could have possibly anticipated the events that procured in the past two years. As we adjust to this new normal and welcome 2022, we must continue to manage many of the same risks we faced before the pandemic, except with new and different insights, tools, and learning. Remember the three quintessential factors for any successful vendor risk management program: preparation, information, and teamwork.