Do you have an implemented third-party management strategy?

This question is asking whether your organization has a formal, documented strategy for managing relationships with third-party vendors and service providers. A third-party management strategy is a framework that defines how your organization evaluates, onboards, monitors, and terminates relationships with external entities that have access to your systems, data, or provide critical services. Why this matters in security assessments: 1. Supply chain security: Vulnerabilities in third-party systems can impact your organization's security posture 2. Compliance requirements: Many regulations (GDPR, HIPAA, etc.) require oversight of third parties handling sensitive data 3. Risk management: Third parties introduce additional risks that need systematic management 4. Incident response: Clear processes are needed when security incidents involve third parties A comprehensive third-party management strategy typically includes: - Risk assessment procedures for evaluating new vendors - Security requirements and contractual obligations - Ongoing monitoring and periodic reassessment processes - Offboarding procedures to ensure secure termination of relationships When answering this question, be specific about your formal strategy, including whether it's documented, who oversees it, and key components. If you have a partial strategy or one under development, be transparent about its current state.