Preparing for vendor validation as a physical security organization
The Vendor Landscape in Physical Security
When physical security integrators help a customer build a security solution to protect their physical locations, there are frequently multiple sub vendors. In IT security, a project bill of materials may only have two main line items, the product, and the services to install and maintain it. The physical security world on the other hand has vastly more complexity in building out a solution. It is not uncommon to have hundreds even thousands of line items to build a fully baked enterprise security solution. Access Control, Video Monitoring, Intercom, Garage Systems, all of these tangible physical systems each may have hundreds of components.
When you think about how these solutions are sourced, the number of vendors could end up being a list of 10 to 20 independent organizations. Add to this that you must source through a distributor for some, a reseller for others, and direct for a few. This means that when it is time to do your due diligence on your vendors, the effort is not trivial.
Why does this due diligence matter? Because now, the customer needs to know more about your supply chain than ever before. COVID had such an impact on business, that now we want to ensure that we are as “vertically aligned” in our sourcing as much as possible. Buying from well-known, reputable organizations, and ensuring that they can deliver has never been more critical.
What is the benefit of all this due diligence?
Customers of most integrators benefit from knowing the supply chains behind their integrator will not fail and disrupt the project in process. They also benefit from knowing that when a solution has been installed, that support for all of their devices is not going to be a problem.
When an integrator begins the process, probably during a bid, they will be asked now to supply far more data than they were in the past. The submittal package is more than just documentation and warranties for all the installed solutions. Now it includes a vendor approval process to ensure the integrator is a sound business. They have solid cyber security practices, that they can deliver on time, and service the systems effectively over the lifetime of the solution. After all, rip and replace of a dedicated physical security solution is no joke.
What are the options for you to prove your “trustability” or share your internal due diligence with your customer? In the past, it was a combination of emails, someone in your office haunting various websites for documentation, and looking at what you had on hand in the office. But there are easier ways to do all of this, and Vendict is the partner to help you do it.
Introducing Vendict
Vendict is a solution that was built at its heart as a solution to help you answer security questionnaires quickly, accurately, and with full knowledge of the Governance Risk and Compliance (GRC) domains.
The value proposition though is that it is more than just answering a questionnaire. It has to do with the entire end to end process.
End to End Process
The Vendict solution gives you an end-to-end process to keep security information organized. It helps you to improve your security posture, share your security practices, and put your best foot forward with a review board and your customers. By handling inbound questionnaires, answering questions with a GRC Mentor, doing gap analysis against regulatory frameworks, and sending content requests out to your vendors and partners, you can be ready for the toughest review board.
The first way to being proving your ability to execute is to share the important data securely. This is a fast way to get your customer engaged, show your company’s professionalism, and responsiveness up front.
Vendict Trust Center
The concept of a trust center is common in the IT industry, and is be a powerful tool for security vendors, and integrators. The essence of a trust center is to provide detailed information at the beginning of the process. A trust center typically consists of a public display of certifications your organization has achieved. These certifications may be a SOC-2, FEDRAMP, or any number of process-oriented certifications like ISO, or GDPR, a privacy focused framework. There may be a long list of certifications for your company, and the solutions you sell. Displaying them in your trust center up front helps to prove your company’s compliance, trustability, and business strength.
You can also host the documents you may use to answer questions, including documentation on products you sell, solutions you build, or services you offer. These documents are presented in a single portal (with access control for sensitive documents). Important security documents can be locked behind a Non-Disclosure Agreement (NDA) or share it by request only (that you approve). Public facing documents can be freely downloaded.
Beyond hosted documentation, a key feature is the ability to ask questions of your shared documentation. Questions are answered by an AI agent that follows your restrictions for private versus public content and lets the review board staff ask questions until they are satisfied. If they ask questions and don’t get a response, you are notified of the gap, and you can answer it directly outside of the trust center. This can reduce the “back and forth” that takes so much time.
Vendict Questionnaire Response
The Vendict Trust Center is connected to a back-end system that is used to answer security questionnaires. This allows you to use the exact same evidence and Q&A library for a trust center as the data you use to answer a security questionnaire. Vendict is known for its ability to respond to a security questionnaire that has a GRC focus. A typical uploaded questionnaire can be returned fully filled out in minutes. These tools are hallucination free because they only work from your document library, not the internet or external sources. As such, you can train your own library to be more accurate, and none of that training goes beyond your specific tenant.
Vendict GRC Mentor
Vendict’s GRC mentor is built into its response engine. This mentor has specific knowledge of the GRC frameworks, and the security domains reviewed by boards for security purposes.
Having a GRC mentor at your side can help you answer accurately and effectively on GRC questionnaires. Instead of reading a set of questions and not knowing where to start, the GRC mentor will offer suggestions to ensure you answer effectively.
The mentor is collaborative as well. You can ask questions to the mentor through integrated apps as well, such as Teams, Slack, or via a Chrome Browser plugin. This makes it easy to get this expert help across your entire team as needed. Think of it as your GRC Chat Buddy.
Vendict Framework Evaluation
In addition to answering questionnaires from customers and their boards, you can assess your own evidence library against known frameworks. The library you use to answer security questionnaires can be run against any of the 35 standard frameworks. NIST is common for government bids, HECVAT for educational institutions, HIPAA for healthcare projects, SOC-2 for hosted solutions, ISO for international organizations.
Getting a quick insight into how effectively your documentation supports these frameworks can prepare you to talk to the review board. If you score well, you have the answers to hand. If you don’t, you can use the framework assessment tool to help you identify the gaps in the answers you need to be prepared.
Vendict Third Party Risk
The final aspect of this solution is the ability to work effectively with your partners. As an integrator, your security posture is affected by all the products you source. As such, you would likely want to source the right content from your suppliers up front. When you bid a contract, and you gather all the data for a bid, you may have to reach out to 10 or 15 vendors for each bid.
The vendors that are most critical to your success must also be reviewed. But you can’t just give your vendor’s phone number and website to the customer. So having a tool to request all the appropriate documentation from the vendor is a powerful business enabler.
With each typical vendor having their own security posture documentation, combined with all their product literature you need to execute on a deal, you should have a tool to bring it all together. Vendict’s Vendor Management application lets you request any type of file, be it for a compliance requirement, or just getting product literature, in a secure portal.
In addition to that, wouldn’t it be great if you could then evaluate your vendor’s documentation to see how well it supports your compliance requirements? You can request any kind of document, but also ask your vendors to supply their security posture evaluations, in the form of questionnaires to them.
The Vendict Third Party Risk tool allows you to do both. Gather all the important information, send industry standard questionnaires, or custom questions as you see fit, and give you a single place to aggregate their documentation.
Go beyond your current process
Knowing you can pull all the data you need together to successfully bid, win, and run a project will help you become more efficient as a value-added reseller, integrator, or dealer. Make bidding easier and keep track of everything in a single location to keep your future projects informed and on track.