Skip to main content
FoxPointe FoxPointe
  • Services
    • Cyber Risk, Assurance and Compliance
    • IT Audit
    • Penetration Testing
    • General Consulting
    • Virtual Chief Information Security Officer (vCISO)
  • About Us
    • Management Team
    • Credentials
    • Careers
  • Resources
    • Events
    • News
    • Videos
    • Whitepapers
  • Blog
  • Contact Us
FoxPointe
  • Services
    • Cyber Risk, Assurance and Compliance
    • IT Audit
    • Penetration Testing
    • General Consulting
    • Virtual Chief Information Security Officer (vCISO)
  • About Us
    • Management Team
    • Credentials
    • Careers
  • Resources
    • Events
    • News
    • Videos
    • Whitepapers
  • Blog

Enter Keywords

  1. Home
  2. Blog

FoxPointe Security Hub

Reducing Third-Party Risk: Ongoing Assessment and Monitoring

April 15, 2021

In this day and age, the risk of cybersecurity threats is becoming a concerning topic for organizations. Reducing the risk of data breach has become a top priority for many businesses.

When it comes to minimizing risk, an often-overlooked area is third-party risk. Many organizations include an initial vetting process when onboarding a third-party vendor, but a key proponent for mitigating vendor risk is continued assessment and monitoring.

There are various ways that organizations can perform third-party due diligence; one such way is to practice ongoing assessment and monitoring of vendor control environments by the utilization of SOC reports.

What are SOC Reports?

A SOC report is designed to help organizations, that provide services to other entities, build trust and confidence in the services performed and the controls related to the services performed through an independent auditor.

There are three main types of SOC reports, each designed for a different need:

  • SOC 1 – Reports on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting
    • These reports meet the needs of users to evaluate the effects that the controls have at the service organization on user entity financial statements.
  • SOC 2 – Reports on Controls at a Service Organization Relevant to Security, Availability, Processing, Integrity, Confidentiality or Privacy.
    • These reports meet the needs of users that require detailed information and assurance related to the controls of a service organization relevant to availability, processing, and integrity of the systems used to process user data, along with the confidentiality and privacy of the information processed by these systems.

There are also two types of reports for the engagements mentioned above:

    • Type I – Reports on the design of the controls that an organization has in place at any given point in time.
    • Type II – Reports on how an organization operates its controls over a period of time.
  • SOC 3 - Trust Service Criteria for General Use Report
    • These reports are designed to meet the needs of users who require assurance about the efficacy of their controls but without the extra information provided by a SOC 2 report. Although they are similar, with SOC 2 and SOC 3 reports overall containing the same information, SOC 3 reports are shorter and do not include the same level of detail that SOC 2 reports afford.

Why Are SOC Reports Important to the Reduction of Vendor Risk?

The importance of obtaining a service organization SOC Report is having assurance that vendor controls are in place and operating effectively. Periodic review of SOC reports is an important aspect of vendor risk management, ensuring that third parties have sufficient security measures in place to minimize the risk of a breach and that the organization’s data is protected.

Various Articles I Read to Get Ideas on Vendor Risk Management

  • Info Security Magazine: SOC 1, 2, & 3 Audit Reports, and Why You Need One
  • Venminder: How to Do Vendor Due Diligence
  • Venminder: 10 Best Practices for Successful Vendor Risk Assessments
  • BITSIGHT: How Continuous Monitoring Revolutionizes Third-Party Risk Management
  • UpGuard: What is Vendor Risk Management: The Definitive Guide to VRM
  • Citation for the SOC Report Information

For additional cybersecurity information, please reach out to our experts at FoxPointe Solutions today!

This article was written and produced by Jessica Ramirez, FoxPointe Solutions. Looking to get in touch with Jessica? Reach out today: jramirez@foxpointesolutions.com.

FoxPointe Solutions is solely responsible only for the content of FoxPointe Solutions authored information and is subject to change at any time. Any forward-looking statements are not predictions. FoxPointe Solutions is not responsible for any errors or omissions, or for the results obtained from the use of this information. Questions regarding your legal or compliance position should be addressed through your legal counsel, security advisor and/or your relevant standard authority. Nothing contained herein should be used nor relied upon as advice nor constitute a consultant-client relationship.

Data Privacy Risk Management Cybersecurity   cyber strategy information risk management
Share
Twitter Facebook LinkedIn
  • Topics
  • Authors
  • Data Security (13)
  • Data Privacy (15)
  • Compliance (4)
  • Risk Management (8)
  • Cybersecurity Alert (7)
  • Cybersecurity (25)
  • Archive (34)
  • Charlie Wood | PCI QSA, CISA, CRISC, CISM
  • Carl Cadregari | CISA, CCSFP, CTPRP
  • Allison Hall | PCIP, CCSFP
  • Courtney Caryl | CCSFP, CHQP
Let us show you how we can help
Request Quote
FoxPointe

171 Sully's Trail
Pittsford, NY 14534

Call 844-726-8869
or Contact Us

Subscribe to the Blog

Services
Cyber Risk, Assurance and ComplianceIT AuditPenetration TestingGeneral ConsultingVirtual Chief Information Security Officer (vCISO)
Company
Management TeamAbout UsBlogCareersPrivacy Policy
©2023 FoxPointe
Website by Corporate Communications, Inc.
We use cookies and other technologies to optimize site functionally, analyze website traffic, and share information with our service and analytics partners. To view our Privacy Policy, which discusses cookies, click here. By continuing to use & browse our services, you agree to our Privacy Policy, our use of cookies, and the Terms and Conditions.