Trend 7: Supply chain security and vendor risk management (VRM) gain focus

As organizations increasingly collaborate with partners and outsource work, the risk of compromise also increases in the supply chain. VRM identifies a business' vendor relationships and associated cyber risks. The tool categorizes risks from vendors and helps track and mitigate those risks. VRM also tests potential suppliers before they are approved as vendors. Multiple regulations, including the GDPR, put the onus of VRM on the organization, holding it responsible for any breach or data loss.

GRC automation platforms from RSA, MetricStream, and ServiceNow provide integrated VRM capabilities. Most solutions are now available in the cloud as SaaS models, reducing implementation time and operations costs. The challenge of large volumes of vendor assessments has led to a new category of vendors like CyberGRX and OneTrust that provide risk exchange capabilities for cost reduction. Like BitSight and RiskLens, others provide continuous vendor assessments using publicly exposed assets and information on the dark web.

A leading packaged food retailer in the U.S., in association with Infosys, defined its VRM process and the vendor tiering criteria to create tier-specific security assessments meeting its risk appetite. All workflows and processes were automated using the RSA Archer product. Post-implementation, Infosys provides vendor risk assessments and ongoing remediation governance as a managed service.