I have created a SIG specifically for third party vendors who provide my company with data center services. However, even after vendor consolidation efforts I still have over 20 vendors who receive this specific SIG. Being able to use one questionnaire for 20+ vendors is a definite plus, but the manual effort to evaluate all of the response is very time consuming. This situation is repeated with other SIG responses. Is there any way I can automate this effort?  

Absolutely. The SIG Management Tool (SMT) along with certain SIG functionality was specifically designed to address this issue.

Whenever a SIG has been scoped for a specific set of third party services it is always advisable to create a Master SIG. This is done by navigating to the "Formula Notes" tab of the SIG and selecting "Master" in the drop down box. Doing this converts the SIG into a Master SIG. The purpose of a Master SIG is to use it as a template for assessing SIG responses. Once you have created the Master SIG by clicking the drop down selection, you complete the process by answering all of the SIG questions relevant to the type of services provided in the manner you want them answered based on the services provided and the level of security you require for those services. This gives you a completed Master SIG which contains answers to the questions to evaluate the responses received by your vendors.

Here's where the SMT becomes so valuable. By using the "Compare" function in the SMT you are able to automatically compare all of the answers in the SIG received from a vendor to the "correct" answers you have already defined in the Master SIG. By using the SMT to perform this comparison a report will be generated by the SMT showing every instance where your answer and the answer provided by your vendor differ.

There are additional ways to filter and create comparison reports, but they go beyond the scope of this column. However, a full detailed description of how to use the SMT to conduct automated comparisons of SIG responses to Master SIG's is detailed in the SIG Issuers Guide provided with every SIG. In addition to explaining the comparison functionality of the SMT, the SIG Issuers Guide includes many other useful tips on how to use the SMT and scope the SIG.

If you're not already familiar with the SMT, I strongly suggest that you review the SIG Issuers Guide.

During discussions in 2013 to determine the next risk areas that should be addressed by the Shared Assessments Program Tools, the focus rapidly turned to software security. As we polled our members we found that many of them were concerned with the security of the software being provided by their vendors, and more importantly what could they do to determine if the software was developed and maintained in a secure environment.

...Read more