Profile

We have gone to a path of doing a Security Assessment which details how a vendor is better or worse than if we were handling data within locally managed systems. Part of that report might includes any recommendations to make the vendor compliant or contract changes and sharing vulnerability reports, ...

We don't see a lot of resistance, but vendors try to be efficient and submit old and outdated HECVATs. We require one completed in the last 12 months and it must be a version 3 HECVAT. I find half the vendors will heavily reference the SOC 2 Type 2 or even offer access via an NDA. If they do either, ...