2016 vendor risk management benchmark study · maturity levels for all aspects of vendor risk...

© 2016 Provi Inc. An Equal Opportunity Employer M/F/Disability/Veterans. © 2016 The Santa Fe Group, Shared Assessments Program. All rights reserved. To learn more, visit sharedassessments.org and provi.com/vendor-risk. 61 % 65 % Organizaons that have an incident response plan in place to respond to events at vendors or third pares Organizaons with an incident response plan in place that test the plan with vendors or third pares 2016 Vendor Risk Management Benchmark Study The Shared Assessments Program and Provi Examine the Maturity of Vendor Risk Management Companies appear to have reached a posive turning point with regard to managing their vendor risks. The results of the latest Vendor Risk Management Benchmark Study from the Shared Assessments Program and Provi indicate that: • Organizaons in all industries are increasing their focus on managing vendor and third party risks. • Levels of maturity in different vendor risk management components have noceably improved. • Organizaons with high levels of board engagement with regard to vendor cybersecurity risks report higher maturity levels for all aspects of vendor risk management. About the Survey The Vendor Risk Management Benchmark Study was conducted online in the second and third quarters of 2016, with 391 execuves and managers parcipang in the study. For each vendor risk component, respondents were asked to rate the maturity level as that component applies to their organizaon, based on the following scale: 5 = Connuous improvement – benchmarking, moving to best pracces 4 = Fully implemented and operaonal 3 = Fully defined and established 2 = Determine roadmap to achieve goals 1 = Inial visioning 0 = Do not perform Program Governance Policies, Standards and Procedures Contracts Vendor Risk Idenficaon and Analysis Skills and Experse Communicaon and Informaon Sharing Tools, Measurement and Analysis Monitoring and Review Vendor Risk Management Maturity Levels 2016 Companies with high board engagement in vendor cybersecurity 2016 Overall index 2015 Overall index 4 3.5 2.5 3 2 CATEGORY

Upload: others

Post on 13-Aug-2020

2 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: 2016 Vendor Risk Management Benchmark Study · maturity levels for all aspects of vendor risk management. About the Survey The Vendor Risk Management Benchmark Study was conducted

To learn more, visit sharedassessments.org and protiviti.com/vendor-risk.

61 % 65 % Organizations that have anincident response plan in placeto respond to events at vendorsor third parties

Organizations with anincident response plan inplace that test the plan withvendors or third parties

2016 Vendor Risk ManagementBenchmark StudyThe Shared Assessments Program and Protiviti Examine theMaturity of Vendor Risk ManagementCompanies appear to have reached a positive turning point with regard to managingtheir vendor risks. The results of the latest Vendor Risk Management BenchmarkStudy from the Shared Assessments Program and Protiviti indicate that:

• Organizations in all industries are increasing their focus on managing vendor and third party risks.

• Levels of maturity in different vendor risk management components have noticeably improved.

• Organizations with high levels of board engagement with regard to vendor cybersecurity risks report higher maturity levels for all aspects of vendor risk management.

About the Survey The Vendor Risk Management Benchmark Study was conducted online in the second and third quarters of 2016, with 391 executives and managers participating in the study. For each vendor risk component, respondents were asked to rate the maturity level as that component applies to their organization, based on the following scale:

5 = Continuous improvement – benchmarking, moving to best practices4 = Fully implemented and operational3 = Fully defined and established2 = Determine roadmap to achieve goals1 = Initial visioning0 = Do not perform

Program Governance

Policies, Standards and ProceduresContracts

Vendor Risk Identification and Analysis

Skills and Expertise

Communication and Information Sharing

Tools, Measurement and Analysis

Monitoring and Review

Vendor Risk Management Maturity Levels

2016 Companies withhigh board engagement in vendor cybersecurity

2016 Overall index 2015 Overall index

3.5

2.5