Announces General Availability of the HITRUST Assessment XChange for ServiceNow

Frisco, TX, January 23, 2025 

HITRUST, the leader in information security assurance for risk management and compliance, today announced the General Availability (GA) of the HITRUST Assessment XChange App for ServiceNow, a transformative solution that incorporates numerous HITRUST innovations to deliver practical and effective third-party risk management to organizations of all sizes and maturities.

With this release, HITRUST delivers on its commitment to making strong, efficient, and effective TPRM truly practical by embedding its proven, best-in-class assurance programs directly into the ServiceNow platform — providing organizations with seamless automation, actionable insights, and reduced assessment fatigue.

Delivering Innovation: A Fully Integrated, Automated Approach to TPRM

The HITRUST TPRM XChange Application for ServiceNow enables organizations to seamlessly operationalize and integrate HITRUST’s proven assessment and TPRM toolkit into the ServiceNow platform. It incorporates multiple industry innovations that increase the level of assurance while enhancing efficiency and effectiveness of third-party risk management across broad populations of third parties, including:

• Cyber Threat-Adaptive Controls – Ensures relevance to emerging cyber threats, eliminating the need for additional, redundant questionnaires.
• Broad, Traversable Assessment Portfolio – Provides low, moderate, and high-risk vendor assessments (e1, i1, r2), along with newly released AI Risk Management and AI Security assessments, all built from the highly recognized HITRUST Framework.
• Proven Assurance Methodology – HITRUST’s programs achieve the lowest breach rates among assessed entities, as highlighted in the 2024 HITRUST Trust Report.
• Results Distribution System (RDS) – Enables seamless, detailed, and secure assessment results sharing into the ServiceNow platform enabling efficient and unmatched vendor control analysis.
• Automated Control Inheritance – Reduces redundant assessments by allowing vendors to reuse validated security controls across assessments.

By embedding HITRUST’s prescriptive, scalable, and highly reliable cybersecurity assurance into ServiceNow, the Assessment XChange eliminates inefficiencies through pre-built yet customizable, vendor lifecycle workflows from onboarding to renewal, along with automations and secure data integrations to make risk management actionable—at scale.

Industry Excitement for the HITRUST Assessment XChange for ServiceNow

Daniel Nutkis, CEO, HITRUST

“HITRUST has always set the standard for information protection and cyber resilience. The release of the HITRUST Assessment XChange for ServiceNow marks a major milestone in our drive to close the remaining gaps for practical TPRM. By combining our world-class, proven assurances with the power of the ServiceNow platform, organizations can finally achieve scalable, effective, and efficient third-party risk management.” 

Ryan George, Senior Director, IT Security, UPMC

"HITRUST’s Assessment XChange for ServiceNow addresses a critical need by consolidating third-party risk management functions into a single platform. The ability to operationalize trusted assurance methodologies and results data within ServiceNow allows organizations to streamline vendor assessments, improve risk insights, and reduce inefficiencies—making strong cybersecurity TPRM practical and scalable."

Tom Dill, Executive Director, AdventHealth

“AdventHealth is on a journey to enhance its 3rd Party Risk Management program through the use of ServiceNow. We look forward to integrating the HITRUST ServiceNow TPRM plugin to further strengthen and streamline our current processes.”  

Erica Volini, Executive Vice President, Worldwide Industries, Partners, and Go-To-Market, ServiceNow

“Partnerships succeed best when we lean into our unique skills and expertise and have a clear view into the problem we’re trying to solve. HITRUST’s Assessment XChange for ServiceNow extends our reach well beyond where we can go alone and represents the legacy and goals of the Now Platform. I am thrilled to see the continued innovation we will achieve together to help organizations succeed in the era of digital business.”

Sean Jamison, Director of Security and Risk, Contender Solutions - A Presidio Company

"The HITRUST TPRM XChange App addresses a real-world challenge for organizations: how to manage vendor cybersecurity risk efficiently at scale. By integrating HITRUST’s trusted frameworks into ServiceNow workflows, companies can improve their third-party risk processes without adding unnecessary complexity. This is an important step toward more practical, scalable cybersecurity TPRM."

Learn More and See the App in Action

Visit our website for more information and a demonstration video on the HITRUST TPRM Solution and the HITRUST Assessment XChange for ServiceNow. 

HITRUST continues to expand its integrations across enterprise platforms to help organizations seamlessly operationalize cybersecurity, privacy, and AI risk assurances. Stay informed about future innovations and updates.

HITRUST announces last mile integrations with leading TPRM platforms

FRISCO, Texas, October 3, 2024

HITRUST, the leader in information risk management, security, and compliance assurances, today announces enhancements to the HITRUST Assessment XChange, its comprehensive third-party risk management (TPRM) solution, overcoming legacy challenges and making TPRM practical and effective for organizations across all industries. In addition, HITRUST is announcing integrations with leading TPRM solution platforms to address the current “last mile” challenge of capturing and consuming detail assurance information and performing population risk analysis.

HITRUST Assessment XChange enablement and integration with leading TPRM platforms operationalizes the broad assurance portfolio, Results Distribution System, and other components in HITRUST’s portfolio for more effective and efficient risk management of vendors and partners through pre-built, streamlined workflows enabling end-to-end third-party risk, from initial evaluation, to vendor engagement, through assignments and completion of assurances, to results ingestion and analysis. The total solution enables TPRM programs to significantly improve their information security risk capabilities while reducing time, costs, and complexity.

Managing third-party risk, more specifically information security risk, has long been a critical, yet challenging task for organizations across industries. Data breaches and ransomware incidents stemming from third-party vulnerabilities have caused significant financial losses and eroded trust. Despite the increasing focus on this area, current approaches have been inefficient, impractical, and cost-prohibitive — limiting effectiveness while leaving many organizations vulnerable.

“HITRUST has been working for years to support organizations and their TPRM challenges,” said Robert Booker, Chief Strategy Officer at HITRUST. “The lifecycle that organizations manage for hundreds of third-party suppliers is complex and the outcomes to secure those relationships are essential to the integrity of the services they deliver. We have now reached a significant milestone with the components in place to make third-party risk management not only practical but comprehensive and effective.“

A Comprehensive Solution Built on Industry-Leading Assurances

The HITRUST solution addresses key TPRM functions while offloading the complexities and seamlessly bringing together key components previously not available or not capable of being integrated into a single solution. HITRUST’s TPRM solution is the culmination of many years of development, designed to address the gaps in existing and traditional methods, such as assessments with limited assurance, incomplete control selection, need for gap self-assessments and questionnaires, and non-existent third-party population risk analysis and engagement. Unlike these outdated and limited approaches, HITRUST’s solution provides:

Comprehensive Framework with Threat-Adaptive Controls: HITRUST’s continuously updated framework adapts to current and emerging cyber threats, eliminating the need for custom questionnaires and ensuring the controls maintain relevance to emerging cyber threats.

Multiple Assessment Options: A broad portfolio of assessments covering third-party suppliers with different levels of inherent risk all delivered through a portfolio of low, medium, and high assurance levels for information security in addition to the recently announced AI assessments. 

Streamlined Results Delivery: Organization’s TPRM solutions can electronically receive validated assessment results, enabling faster, more efficient consumption, and risk analysis with real-time updates of status, progress, and remediation activities through seamless integration with the HITRUST Results Distribution System.

End-to-End Security Risk Management: Enabled by integration between the HITRUST Assessment XChange and key TPRM solutions, organizations can gain access to comprehensive management of the vendor information risk process, from initial onboarding to the evaluation and management of conformity and corrective action plans. The platform supports functions such as guided setup and configuration, assignment of appropriate assessments, digital receipt of summary and detailed assessment results, regular renewals and re-assessments based on vendor changes, management reporting, and detailed third-party population analysis at the control specification level. It efficiently manages these processes across vast vendor populations, ensuring appropriate rigor and assurance at every step.

Staff Augmentation: Managed and integrated services are available from the HITRUST Assessment XChange to support vendor engagement, outreach, education, and assessment. These optional services are available to complement internal governance efforts.

Industry Adoption and Next Steps

Healthcare, finance, and other industries are already benefiting from HITRUST’s offerings that support TPRM, but the additional services in the HITRUST Assessment XChange and integration with TPRM solutions will take risk management to the next level by providing unprecedented visibility into vendors’ information risk.

“Existing approaches to third-party risk management, such as relying on spreadsheets or limited control sets or assurance assessments, have proven insufficient to manage risk. HITRUST now delivers a complete solution that includes a broad portfolio of assessment options that maintain control relevance coupled with a proven effective assurance model to effectively address third-party information risk,” said Erika Del Giudice, IT Assurance Services Principal at Crowe LLP. “With the addition of its ServiceNow and other integrations, HITRUST now offers a complete solution that is not only powerful but also practical for organizations to employ”.

First Planned Integration: ServiceNow (Third-Party Risk Management) TPRM

As part of this strategic expansion, HITRUST today announced that the first planned integration of The HITRUST Assessment XChange with ServiceNow’s Third-Party Risk Management (TPRM) solution to operationalize HITRUST's TPRM portfolio and methodology within a single pane of glass.

The joint effort enables customers to harness the power of the Now Platform while enjoying the full benefits of HITRUST’s comprehensive information security and risk management capabilities.

ServiceNow’s expansive partner ecosystem and partner program is critical in supporting the $275 billion forecasted market opportunity through 2026 for the Now Platform. The ServiceNow Partner Program recognizes and rewards partners for their varied expertise and experience to drive opportunities, open new markets, and help customers transform their business across the enterprise. 

As a Registered Build Partner, the certified integration enables HITRUST to create better experiences, drive value for customers and enable organizations. The integration is expected to be available in the ServiceNow Store by the end of 2024.

Accepting Applications for ServiceNow Private Preview

HITRUST is currently accepting applications for participation in the private preview program and expects general availability of the certified ServiceNow integration by the end of 2024, with additional GRC and TPRM platform integrations prioritized for 2025 and beyond. Attendees at HITRUST Collaborate have the first opportunity to see the tool and learn about its features and functionality.

To apply for the private preview program, go to: https://info.hitrustalliance.net/preview/

As financial technology (fintech) continues to evolve, third-party vendor risk management for financial institutions has become a mission-critical priority. In a sector where digital services, data-driven solutions, and external partnerships are the norm, overlooking third-party risk can lead to severe regulatory, operational, and reputational consequences.

This blog explores the unique challenges fintech companies face when managing third-party vendors and how adopting a structured, scalable assurance program like HITRUST can turn risk into a strategic advantage.

The importance of TPRM in fintech

The growing dependence on external vendors

Financial cybersecurity has always been a significant matter. Fintech thrives on agility and innovation — often achieved through partnerships with niche technology providers, cloud service vendors, and data analytics firms. This interconnected ecosystem accelerates time to market but also expands the attack surface. Each vendor relationship introduces potential vulnerabilities that can be exploited if not properly managed through a rigorous finance TPRM program.

What’s at stake: Data, compliance, and reputation

Financial institutions deal with sensitive customer data, proprietary algorithms, and regulatory scrutiny. A single third-party breach can expose this data, violate compliance requirements, and damage customer trust. The cost of a security failure is not limited to fines and downtime — it can derail investor confidence, trigger audits, and stunt growth. That’s why third-party risk management in the financial tech industry is essential.

Understanding third-party vendor risk

What qualifies as a third party?

In the financial technology sector, third parties are any external entities — vendors, partners, or service providers — that support critical business operations. This includes cloud infrastructure providers, payment processors, customer support outsourcers, KYC vendors, and even open-source software contributors. Each must be evaluated not only on performance but also on how they manage risk.

Common types of risk in financial technology

Operational risk

When a key vendor experiences downtime or fails to deliver as expected, it can halt operations, delay product releases, and frustrate customers. In a fast-paced industry like fintech, even brief disruptions can carry outsized consequences.

Security and privacy risk

Third parties often require access to sensitive systems or data. If their security posture is weak, it opens the door to breaches, insider threats, or data misuse. Fintechs must ensure vendors align with stringent security and privacy expectations.

Regulatory and compliance risk

Fintechs operate under a complex web of regulations such as GLBA, SOX, and PCI-DSS. Non-compliance by a vendor can trigger violations and fines for the financial institution itself, even if the organization has otherwise maintained compliance.

Fintech-specific TPRM challenges

Fast growth and loose controls

Third-party vendor risk management for financial institutions is critical. Startups and scaling fintechs are often laser-focused on innovation and growth. Risk management may be deprioritized, leading to ad hoc vendor evaluations and inconsistent controls. This reactive approach makes TPRM fragile and unsustainable.

Compliance complexity across jurisdictions

Many fintech companies operate across states and countries, each with distinct regulatory frameworks. Third-party risk management for fintech across these diverse jurisdictions requires a harmonized, auditable approach to compliance.

Cloud-native tech stacks and data sprawl

Fintechs are heavily cloud-based, often relying on multi-cloud or hybrid environments. This increases the complexity of securing data, enforcing consistent controls, and tracking how and where sensitive information is stored, accessed, and shared.

Best practices for managing vendor risk in fintech

Clear vendor classification and risk tiers

Not all vendors carry the same level of risk. Fintechs should categorize vendors based on access levels, data sensitivity, and operational impact. This finance TPRM approach allows for right-sized due diligence and resource allocation.

Build a scalable onboarding and review process

Vendor onboarding should include standardized risk assessments, contract clauses for compliance and security, and clear documentation. Regular reviews must be scheduled based on the vendor’s risk tier — higher-risk vendors require more frequent assessments. Explore our quick guide to TPRM best practices for establishing a scalable process for third-party vendor risk management for financial institutions.

Continuous monitoring of TPRM

Point-in-time assessments are no longer sufficient. Continuous monitoring — enabled through automation and threat intelligence — helps identify changes in vendor risk posture. This proactive stance helps prevent small issues from escalating into crises.

How an assurance program like HITRUST can help

Bringing structure to risk assessment and monitoring

The HITRUST third-party risk management solution offers a comprehensive assurance program that enables tailored risk management based on business needs. It streamlines vendor management and allows organizations to monitor vendor security gaps and remediations. It makes third-party vendor risk management for financial institutions effective and efficient and ensures vendors meet rigorous security and compliance expectations.

Making audits easier with pre-mapped controls

HITRUST's pre-mapped controls to frameworks like ISO, NIST, and PCI-DSS mean fewer gaps and faster audit preparation. Vendors can demonstrate compliance with multiple standards using a single assessment, reducing audit fatigue and increasing credibility with stakeholders. For a deeper dive into optimizing your TPRM strategy, read our blog.

Turning vendor risk into a strategic advantage

Rather than being a burden, effective third-party risk management in financial tech companies can become a differentiator. Demonstrating robust, scalable TPRM builds trust with customers, investors, and regulators. It signals maturity, readiness for growth, and a commitment to responsible innovation.

By adopting the HITRUST TPRM approach, fintech companies gain the structure and confidence to scale securely — protecting data, preserving trust, and accelerating market access.

Learn how HITRUST can help simplify third-party risk management for fintech companies.

If you’re still accepting SOC 2 reports from your vendors as your primary assurance mechanism, it’s time to take another look. SOC 2 was once considered a strong security indicator for many organizations. However, it has now become little more than a check-the-box exercise. 

Why SOC 2 isn’t enough 

The threat landscape has evolved. Data breaches have become harder to detect. Cyberattacks have become more sophisticated. Bad actors are finding new ways to target weak vendors and gain access to sensitive data from multiple organizations. Not just that, ransomware attacks have also increased, disrupting business continuity and causing major reputational and financial damages.     

The problem? SOC 2 has not evolved to tackle these new-age challenges. Instead, it has been trivialized to the point where it no longer signifies robust assurance. 

Automation, inconsistency in auditing practices, and vendor-scoped control selection result in many SOC 2 reports providing limited insight into a vendor’s actual security posture. Often, they also miss critical control areas, like third-party risk management (TPRM) and email security, putting your organization at risk of inherited vulnerabilities. 

In a time of escalating ransomware attacks and increased regulatory scrutiny, the assurance mechanisms you rely on need to do more than just say that your vendor is secure. They need to prove it. 

That’s where HITRUST certification comes in. 

Why HITRUST is a better alternative  

HITRUST offers an effective, standardized approach to vendor risk management.  

Unlike SOC 2, HITRUST  

• Stays ahead of emerging threats with threat intelligence data  

• Uses a comprehensive, prescriptive framework aligned with 60+ standards 

• Delivers proven results as 99.41% of HITRUST-certified environments remained breach-free in 2024 

• Offers scalable assessment options based on business needs and vendor’s risk profile 

• Streamlines managing large volumes of vendors and reduces manual effort 

• Encourages continued risk tracking and remediation  

But what does this mean for your vendor risk management strategy? And how can you adopt this effective TPRM approach? 

To explain this, we’ve created a concise eBook to help you evaluate SOC 2’s limitations and explore why modern organizations are replacing it with HITRUST certification as their new TPRM baseline. 

Read the eBook now to learn more: Why It’s Time to Rethink SOC 2 in Third-Party Risk Management

It’s time to move from traditional, checkbox compliance to proven cybersecurity assurance that can truly reduce risk and help protect your business. Choose HITRUST certification over SOC 2 reports to strengthen your TPRM program.  

One of the most persistent challenges in Third-Party Risk Management (TPRM) is the growing tension between vendors and their customers over how much information is “enough” to complete the vendor due diligence process and gain meaningful assurance. At the heart of this tension is a fundamental friction: vendors are understandably cautious about sharing detailed internal information, while customers are under pressure to demand more of it. 

Vendor caution: Balancing security and disclosure 

For vendors, fear is real. Providing detailed documentation, such as audit reports, penetration test results, or internal security policies, feels like handing over the blueprint to their security house as part of the vendor due diligence process. There’s anxiety that this information could be misused, misinterpreted, weaponized in future business disputes, or maybe lost or breached by the customer. Many vendors worry about loss of control, leaks of sensitive competitive data, or being penalized for perceived gaps taken out of context. 

Customer expectations: Regulatory pressure and risk management 

On the other hand, customers feel the weight of regulatory expectations, board oversight, and real cyber risk. Their job is to protect their organization and to do that effectively, they want as much transparency as possible. Security questionnaires are long, evidence requests are deep, and certification reports are just the starting point. The result? A game of chicken where both parties end up frustrated, and risk assurance is delayed — or worse, superficial. 

This imbalance isn’t sustainable. 

Building a culture of trust: Bridging the gap  

TPRM will not improve unless both sides are willing to meet in the middle and work together. Creating a true partnership requires addressing the core challenges in third-party risk management directly and understanding the need for a balanced approach. Both vendors and customers must share the responsibility for the security and integrity of the information exchanged.  

This means rethinking how organizations define “enough” information for trust. Not everything must be disclosed in raw form. Vendors can offer redacted summaries, attestations from credible third parties, or scoped access under NDA. Customers, meanwhile, must move beyond checkbox audits and begin aligning questions with actual risk, focusing on what truly matters instead of what is easiest to ask.  

Not all controls are created equal. Only a small percentage actually protects against threats today. Customers should focus on those controls and not every control, which is a compliance exercise instead of a security practice. A deep dive into critical security areas, such as incident response protocols, vendor access controls, and data encryption standards, will have a much more meaningful impact than combing through irrelevant, blanket requirements. 

Standardization can also help. Frameworks like HITRUST offer a common language to reduce back-and-forth. By adopting a unified third-party risk management framework, vendors and customers can reduce complexity and avoid unnecessary friction. Frameworks and certifications like HITRUST set clear, actionable security standards that help organizations move beyond the guesswork of ad-hoc risk management practices.

But the real unlock is cultural: mutual respect, shared goals, and clear expectations. When vendors and customers collaborate — not compete — on risk transparency, both sides benefit. Trust is built faster, assurance is stronger, and business moves forward. 

Looking ahead: Embracing partnership for a secure future 

The future of TPRM isn’t more friction. It’s more partnership. As both sides work together to enhance transparency and security, TPRM will evolve into a more proactive and sustainable process.  

Third-party risk management (TPRM) in financial services has become increasingly critical as institutions rely more on external vendors and technology providers to enhance their operational efficiency and innovation capabilities. With the financial sector rapidly adopting new technologies, outsourcing key processes, and integrating complex vendor ecosystems, effective management of third-party risks has become essential. But how exactly is TPRM in finance evolving to address these growing challenges, and how can organizations proactively prepare for the future?

Why TPRM is a growing concern in finance

The expanding vendor ecosystem in financial services

The financial sector’s vendor landscape is rapidly expanding, driven by digital transformation, fintech integrations, and a growing dependency on cloud services. Financial institutions today engage with a broader range of third-party providers than ever before. Each new partnership introduces potential vulnerabilities, underscoring the critical importance of robust third-party risk management in finance.

The business impact of third-party risk failures

Third-party risk failures can lead to significant financial losses, regulatory penalties, and severe reputational damage. Incidents involving vendor breaches or compliance lapses have made headlines, highlighting how crucial effective third-party risk management in financial services is for safeguarding trust and maintaining operational stability. Companies must now consider third-party risks as integral to their strategic planning, with clear procedures and mitigation strategies to prevent and respond to such disruptions.

Regulatory pressures and industry standards

Key regulations shaping third-party risk management

Financial institutions face stringent regulatory requirements designed to enhance oversight and manage risks associated with third-party vendors. Key regulations such as OCC Bulletin 2013-29, FFIEC guidelines, and recent updates from regulatory bodies demand comprehensive vendor management programs. Compliance with these regulations is not merely about avoiding penalties but is integral to the institution’s overall risk management strategy, requiring proactive measures and thorough documentation of third-party activities.

The shift toward continuous compliance and oversight

Regulators increasingly emphasize continuous compliance, transitioning from periodic checks toward real-time monitoring and oversight of third-party engagements. This shift necessitates an agile and robust financial TPRM infrastructure capable of ongoing, real-time analysis, rapid response to anomalies, and timely remediation of any compliance issues that arise.

How regulatory expectations are evolving

Regulatory bodies are consistently pushing financial institutions toward enhanced transparency and accountability. The expectations now extend beyond basic compliance to detailed reporting, comprehensive documentation, and demonstrable oversight of vendor activities, particularly around cybersecurity and data protection. Financial institutions must adapt to these evolving expectations, ensuring their third-party risk management programs are robust, transparent, and continuously evolving.

Core strategies for managing third-party risk effectively

Vendor risk assessments and onboarding due diligence

Effective third-party risk management in finance begins with rigorous vendor risk assessments and comprehensive onboarding due diligence. Institutions must thoroughly evaluate potential vendors’ cybersecurity measures, regulatory compliance history, operational resilience, and financial stability. This proactive approach ensures that partnerships are initiated with full awareness of potential risks, enhancing overall security posture.

Ongoing monitoring and performance reviews

Continuous monitoring and regular performance evaluations of vendors are essential elements of successful TPRM in finance. Organizations must establish systematic processes to detect and mitigate risks promptly, ensuring vendor compliance remains consistently high. Regular reviews enable timely interventions, thereby safeguarding institutional operations and reputation.

Working proactively with vendors to improve security posture

Establishing clear expectations and communication channels

Transparent, consistent communication and clearly defined expectations between financial institutions and their vendors are fundamental to effective TPRM. Establishing communication channels and clear contractual terms helps ensure alignment on security practices, compliance responsibilities, and protocols for incident management, thereby significantly reducing the potential for misunderstandings and vulnerabilities.

Encouraging transparency through shared assessments and reporting

Transparency is a cornerstone of effective third-party risk management in financial services. Encouraging vendors to proactively share security assessments, incident reports, and remediation plans fosters an environment of trust and collaboration. This approach not only enhances the security posture of the organization but also expedites responses to potential threats and vulnerabilities.

The role of technology in scaling risk management

Automation tools for vendor tracking and audits

Automation technologies significantly enhance financial TPRM capabilities by streamlining vendor tracking, conducting comprehensive audits, and automating risk assessments. These tools reduce manual effort, minimize errors, and provide accurate, timely insights into vendor performance, enabling financial institutions to manage extensive and complex vendor networks efficiently.

AI-powered risk scoring and threat detection

AI is revolutionizing third-party risk management through advanced risk scoring, predictive analytics, and real-time threat detection. AI-driven systems quickly identify emerging threats and vulnerabilities, enabling proactive management and timely mitigation actions. Financial institutions leveraging AI benefit from enhanced predictive capabilities, reduced response times, and improved overall risk management effectiveness.

Conclusion: Preparing for what’s next in third-party risk

Why HITRUST is the way forward

The future of third-party risk management in financial services requires comprehensive, adaptive, and industry-trusted assurance programs. HITRUST offers structured assessments and continuous compliance monitoring, ensuring a resilient approach for financial organizations to manage vendor risks effectively.

The value of resilience and trust in vendor relationships

Building resilience and trust in vendor relationships is essential in a landscape marked by complexity and evolving threats. HITRUST certifications help financial institutions exceed regulatory expectations, ensuring long-term security and robust operational compliance.

To learn more about how HITRUST can streamline your organization’s vendor assessments and build lasting trust with stakeholders, visit our third-party risk management page.

Third-Party Risk Management (TPRM) is fundamentally broken. It is supposed to provide visibility and control over vendor-related risks, but in practice, it leaves organizations overwhelmed and vulnerable.

One of the issues plaguing TPRM is remediation failure. Plans of remediation in TPRM often fail to translate into tangible risk reduction, leaving organizations with more exposure than they realize.

The follow-through problem in TPRM

Research indicates that organizations remediate only about 10% of the vulnerabilities they identify each month. This is not just a matter of negligence — it is a systemic failure caused by competing priorities, resource constraints, and an ever-growing vendor ecosystem that is too large to manage effectively. Organizations may have robust assessment processes in place, but they struggle to ensure third-party vendors actually follow through on remediation commitments. This results in a backlog of unmitigated risks that continue to accumulate, leaving organizations exposed to known threats that should have been addressed.

The illusion of risk reduction in vendor management

When vendors report that remediation is complete, organizations often lack the reporting mechanisms to verify and measure these efforts. Without proper tracking and accountability, there is no clear picture of whether remediation efforts have truly reduced risk. The lack of standardized third-party assurance only exacerbates the issue, making it difficult to hold vendors accountable and gain efficient visibility.

For example, a healthcare provider may identify vulnerabilities in a vendor’s remote access system and initiate a remediation plan. However, without structured follow-up through TPRM processes, there is no assurance that the vendor has taken the necessary corrective actions. In some cases, issues marked as “resolved” may persist due to miscommunication, incomplete implementation, or new dependencies that introduce similar vulnerabilities.

The continuous monitoring challenge in TPRM

Continuous monitoring is the ideal solution for ensuring remediation in TPRM that leads to lasting security improvements. By maintaining real-time visibility into third-party cyber risks, organizations can track vulnerabilities, measure remediation progress, and proactively address emerging threats. However, few organizations have the means to achieve this because

• TPRM programs are overwhelmed with too many vendors to monitor effectively.
• Many approaches, such as point-in-time assessments, provide only a partial view of risk.
• There is no universally accepted standard for vendor risk management, making consistency impossible.
• Third-party vendors lack incentives to provide sufficient assurance and transparency.

HITRUST helps address these challenges by providing a standardized and scalable framework for assessing vendor security postures. Unlike traditional compliance checklists, HITRUST ensures that security controls are continuously monitored and validated, offering a more dynamic and reliable approach to vendor risk management. Organizations leveraging HITRUST can enforce accountability through a well-defined and industry-accepted certification process that ensures vendors meet and maintain rigorous security standards.

Bridging the gap: Fixing TPRM to enable effective remediation

Organizations must address the broader failures to turn remediation in TPRM into a reality.

1. Prioritizing critical vendor vulnerabilities: Since remediating all vendor-related vulnerabilities is unrealistic, organizations must focus on those that pose the highest risk. Establishing clear prioritization criteria, based on threat intelligence rather than subjective opinions, ensures the most dangerous threats are addressed first.
2. Standardizing third-party assurance: Vendors must be held to consistent security and remediation standards. HITRUST certification provides a reliable mechanism for verifying vendor security postures, enforcing SLAs around remediation, and requiring real-time reporting on security controls.
3. Enhancing reporting and metrics: Organizations need robust reporting mechanisms that track vendor remediation efforts and their impact on overall risk reduction. HITRUST assurance mechanism helps establish clear, auditable metrics that go beyond self-attested compliance.
4. Simplifying stakeholder engagement: Too many stakeholders slow down remediation efforts. Organizations should streamline vendor management responsibilities and clarify ownership of risk mitigation tasks while leveraging HITRUST’s structured governance approach to simplify oversight.
5. Investing in continuous monitoring capabilities: While achieving true continuous monitoring is difficult, organizations can implement more frequent risk assessments, automated scanning, and real-time alerts to improve visibility into vendor risks. HITRUST integrates continuous monitoring requirements that provide an ongoing assessment of vendor compliance and security effectiveness.

Conclusion

Without structured follow-up, organizations become more vulnerable to third-party cyber risks, often without realizing it. HITRUST offers a viable path forward by providing a standardized and continuously monitored approach to TPRM. Remediation will remain an illusion until organizations adopt structured third-party assurances like HITRUST to address systemic flaws.

Vendor risk management is a cornerstone of safeguarding sensitive data and systems, particularly in sectors like healthcare, where protecting patient information is crucial. Despite best efforts, significant blind spots often remain in vendor risk assessments. These vulnerabilities stem from incomplete vendor inventories, prioritization challenges, and a lack of visibility into downstream risks. Understanding and addressing these gaps is critical to bolstering enterprise security.

The scope of the problem

Most organizations struggle to achieve full visibility across their vendor portfolio. Risk assessments often cover only a small fraction of the total number of vendors servicing the organization. This limited scope is largely driven by difficulties in accurately identifying all vendors and the necessity to focus resources on those perceived as most critical. Consequently, vendors that are not deemed mission-critical or high-risk are often overlooked, leaving hundreds of vendors unassessed. This creates significant blind spots, especially in a healthcare environment where even low-risk vendors could inadvertently compromise patient data or systems.

Fourth-party risks amplify the challenge

The problem extends beyond third-party vendors to the broader supply chain. The emergence of vulnerabilities and breaches in fourth-party products and services, such as the Log4j vulnerability, the SolarWinds attack, and the Okta compromise, underscores the cascading risks organizations face. These incidents highlight a troubling reality: many third-party vendors do not maintain accurate inventories of their own supply chain products. This lack of transparency means organizations are often unaware of their exposure to downstream vulnerabilities.

For example, a vendor may rely on a software library that contains a critical vulnerability, yet this dependency remains unreported or undiscovered. In such cases, organizations are blind to the risks posed to their critical data and applications, compounding the difficulty of implementing effective remediation strategies.

Prioritization and risk triage fall short

When faced with limited resources, organizations understandably prioritize vendors based on criticality. Mission-critical vendors and those presenting the highest inherent risks receive the most attention. However, this approach leaves out less obvious forms of risk that can still have significant consequences.

For instance, vendors with remote access to systems, those with physical access to facilities, or those managing privileged accounts might not be classified as critical but can still introduce substantial vulnerabilities. These forms of access can be exploited by malicious actors to bypass traditional security measures, emphasizing the need for a broader view of what constitutes risk.

Addressing the blind spots

To mitigate these gaps, organizations must adopt a more comprehensive and dynamic approach to vendor risk management. Here are some key strategies.

1. Develop a comprehensive vendor inventory: Organizations need complete and accurate inventory of all vendors servicing their operations. This requires cross-departmental collaboration and the use of automated tools to identify and catalog vendors.
2. Enhance visibility into fourth-party risks: Working with third-party vendors to improve transparency in their supply chains is critical. Organizations should mandate that vendors maintain detailed inventories of their own dependencies and report any vulnerabilities promptly.
3. Adapt assessments based on threat intelligence: Incorporating real-time threat intelligence into vendor assessments allows organizations to adapt risk evaluations based on the latest cyber threat landscape. This approach ensures that assessments account for emerging vulnerabilities, attack vectors, and threat actors targeting specific industries or systems. Organizations can identify which vendors are most susceptible to active threats and prioritize remediation efforts by leveraging threat intelligence.
4. Leverage technology and automation: Advanced risk management platforms can help organizations streamline vendor assessments, prioritize risks more effectively, and monitor for vulnerabilities in real time. Automation can also reduce the burden on internal teams, enabling them to focus on higher-value tasks.
5. Adopt continuous monitoring: Risk management cannot be a one-time effort. Continuous monitoring of vendors, their supply chains, and emerging vulnerabilities is essential for maintaining an up-to-date risk profile.
6. Foster collaborative risk mitigation: Establishing strong partnerships with vendors can lead to more proactive risk mitigation. Vendors should be treated as extensions of the organization’s security ecosystem, with clear expectations for compliance and risk management practices.

Conclusion

The blind spots in vendor risk assessments present significant challenges to enterprise security, particularly in high-stakes environments like healthcare. By addressing gaps in vendor inventories, improving visibility into fourth-party risks, and expanding risk assessment criteria, organizations can enhance their resilience against emerging threats. While the task may seem daunting, a proactive and collaborative approach can transform vendor risk management from a reactive necessity into a strategic advantage.

The digital transformation of healthcare has unlocked incredible opportunities to improve patient care and operational efficiency. However, it has also exposed a critical flaw in how third-party risk management (TPRM) is done across the industry.

As digital health technologies proliferate, so do the challenges for security teams tasked with vetting vendors. The traditional questionnaire-based vendor assessment model was long considered the gold standard for due diligence, but it is struggling to keep pace with the volume and complexity of today’s supply chains.

The chokepoint in the procurement process

Healthcare organizations rely on a vast ecosystem of vendors to power everything from telemedicine platforms to electronic health records. But with great reliance comes great responsibility: these vendors must be thoroughly vetted to ensure they won’t introduce vulnerabilities into the organization.

The sheer volume of vendors is overwhelming security teams. Requests for security due diligence assessments are coming in faster than they can be completed, creating a backlog that frustrates internal business owners waiting to onboard critical technologies.

This bottleneck not only slows innovation but also prevents teams from reassessing critical vendors as their technology evolves and threats change.

The vendor's perspective: A broken model

The challenges aren’t limited to healthcare providers. Vendors in the supply chain are equally overwhelmed by the inefficiencies of the current system. Every prospective customer requires some form of security due diligence, and there’s no industry-wide standardization.

Vendors often face

• Inconsistent questionnaires: Each customer has unique expectations, making it impossible to standardize responses.
• Moving goalposts: Security requirements vary widely across healthcare entities, leading to confusion and delays.
• Resource constraints: Vendors with finite security teams struggle to keep up with the growing volume of audits, leaving customers dissatisfied and deals unfinished.

The result is a broken system that delays procurement, frustrates both parties, and introduces unnecessary risk.

Reassessments: The forgotten priority

Adding to the complexity is the need to reassess critical vendors over time. Technology and threats evolve rapidly, and a vendor’s security posture today might not be the same six months from now. However, most security teams are so bogged down with initial assessments that they don’t focus on reassessments. This creates a dangerous gap in visibility and increases the likelihood of vulnerabilities slipping through the cracks.

How do we fix it?

If the traditional TPRM model is broken, how can we rebuild it? Here are a few key strategies.

1. Automate where possible

Leverage tools and platforms that automate aspects of vendor assessments, such as real-time monitoring of security postures, to reduce reliance on static questionnaires.

2. Adopt industry standards

HITRUST, with its risk- and threat-based approaches to security and compliance, provides a framework that can alleviate many of these challenges. Healthcare organizations and vendors can reduce inefficiencies and build a more robust TPRM program by leveraging HITRUST as a standardized assessment mechanism.

3. Join industry collaborators

The Health 3rd Party Trust (Health3PT) Initiative is a proactive group committed to reducing third-party information security risk with more reliable and efficient assurances. It has been established to evaluate, identify, and implement actionable and practical solutions that healthcare organizations can adopt to provide more reliable assurances, consistent information security program reporting, and better visibility into downstream relationships with third parties.

4. Implement continuous monitoring

Use continuous monitoring to track vendors’ security practices over time instead of relying solely on one-time assessments. This approach ensures risks are identified and addressed as they arise.

5. Enhance collaboration

Foster open communication between vendors and healthcare organizations to set clear expectations and establish mutual trust.

The path forward

Vendor risk management is at a breaking point in healthcare, but it doesn’t have to stay that way. We can reduce the burden on security teams and vendors alike by embracing automation, standardization, and continuous monitoring. Most importantly, we can create a TPRM program that balances efficiency with the need for robust security, ensuring that healthcare organizations can innovate safely while protecting patient data and trust.

The time for change is now. Let’s stop letting TPRM be a chokepoint and start using it as a competitive advantage.

Due diligence and security questionnaires have become staples of the vendor risk assessment process for third-party risk management (TPRM). However, as the cybersecurity landscape evolves, our tools must evolve, too. Due diligence questionnaires remain a necessary component but the overreliance on static security questionnaires has become a barrier to effective risk management.

The value of due diligence questionnaires

Due diligence questionnaires are designed to answer critical, relationship-specific questions.

• Scope of engagement: What data, systems, or services will the third party access?
• Compliance requirements: Are specific legal, regulatory, or contractual obligations tied to this relationship?
• Business impact: What is the potential operational or reputational risk if this third party is compromised?

These questions go beyond generic cybersecurity concerns, focusing on the unique aspects of the partnership. They help organizations understand the relationship and ensure that appropriate safeguards align with its specifics. Due diligence questionnaires are a necessary foundation for establishing trust and setting expectations.

The problem with security questionnaires

Security questionnaires often fall short. These standardized forms ask third parties to provide detailed information about their cybersecurity practices.

• How do they handle encryption?
• Do they’ve had recent audits?
• What are their incident response protocols?

While these are important topics, the format of traditional questionnaires introduces several issues.

1. Static and stale data

Security questionnaires provide a snapshot in time that quickly becomes outdated. A vendor might submit a completed questionnaire today, but their environment, controls, or threat landscape could change tomorrow.

2. Lack of context

These forms are often disconnected from the specifics of the relationship. For example, knowing that a vendor uses encryption is less relevant if the relationship doesn’t involve handling sensitive data.

3. Inefficiency

Completing and reviewing lengthy questionnaires is time-consuming for both parties, creating bottlenecks that slow down procurement and vendor risk assessments.

4. Checkbox mentality

Organizations may treat completed questionnaires as a substitute for meaningful engagement, creating a false sense of security without truly understanding the risks.

5. Expertise of analysts

Questionnaires are typically developed by the staff at the requesting organization. The staff may lack the expertise to evaluate control selection or even the ability to interpret the results/responses to the questions.

A better approach to TPRM

To move forward, organizations must reimagine the role of questionnaires in TPRM.

1. Use due diligence for context

Focus on due diligence to capture relationship-specific insights. These questions matter most for tailoring your risk management approach to the specific vendor or partner.

2. Replace static questionnaires with dynamic assessments

Instead of relying on static forms, leverage real-time threat intelligence, continuous monitoring, and assessments that incorporate threat data into the control selection to understand a vendor’s security posture.

3. Focus on collaboration, not compliance

Engage with third parties to address risks collaboratively. Move beyond filling out forms to having meaningful discussions about risks, mitigations, and shared goals.

4. Streamline where possible

Adopt frameworks and framework bodies that actively collaborate on reciprocity to reduce redundancy and streamline the process for vendors managing multiple client requests.

The bottom line

Due diligence questionnaires remain a vital part of TPRM because they provide relationship-specific details needed to assess and manage risks effectively. Security questionnaires, however, need a modern overhaul. By transitioning from static, checklist-driven approaches to dynamic, real-time methods, organizations can focus on what truly matters: building resilient partnerships that mitigate risks and enable business growth.

It’s time to retire the outdated questionnaire model and embrace a more effective, efficient, and adaptive approach to TPRM. After all, managing third-party risks isn’t about ticking boxes — it’s about protecting your organization in an interconnected world.

How often do you rely on a third-party vendor to conduct a business function? Every day or, perhaps, every hour?  

Third-party vendors are an integral part of a business. Organizations rely on them for many services, from processing payments to providing hardware and automating operations. If your organization is growing, your number of vendors is growing, too.  

But have you thought this indeed increases your data exposure? 

Third-party vendors increase cyber risks 

Your risk amplifies as more and more third parties access your systems and data. These vendors use your sensitive data to perform critical business functions. However, if any of these vendors is breached, attackers can gain direct access to your business data and misuse information about your customers and employees.  

So, how do you ensure your vendors have strong security programs before giving them access to sensitive data?  

Third-party risk assessment is crucial to identifying the strengths and weaknesses of your vendors’ security programs. Traditionally, organizations have used multiple tools and tactics to evaluate third-party risks. But these tactics are far from being effective.  

Cybersecurity questionnaires have been one of the popular tactics. Questionnaires are tedious and unreliable. They consume a lot of staff hours, refraining your teams from focusing on more critical tasks. If your teams send out questionnaires, they spend hundreds of hours coordinating with vendors, evaluating answers, and following up on incomplete responses. Furthermore, there is no accurate way of verifying the information provided by the vendors in the questionnaires.  

Organizations need a better third-party risk management (TPRM) program, and that’s why they choose HITRUST.  

HITRUST helps organizations demonstrate trust  

HITRUST offers reliable assurances that are based on its framework, HITRUST CSF. The HITRUST CSF harmonizes best practices from more than 50 authoritative sources. It is widely accepted and transparent as it allows you to verify the sources of the controls. The cyber threat-adaptive HITRUST CSF is updated regularly to help you protect against upcoming threats.  

Not all your vendors need to undergo the comprehensive HITRUST r2 assessment. Based on their needs, size, and risk profiles, HITRUST offers different assessment options. The HITRUST e1 is suited for small vendors or those with limited inherent risks. It also serves as the ideal option for vendors looking to demonstrate a milestone on their journey to a more robust certification. HITRUST i1 is best for mid-level vendors looking for an assessment between the basic e1 and the extensive r2.   

HITRUST makes vendor risk management efficient 

HITRUST offers additional solutions to make vendor risk management efficient. The HITRUST Assessment XChange coordinates with vendors to track assessments and Corrective Action Plans (CAPs) so you don’t have to worry about exchanging hundreds of emails and phone calls. It helps your vendors understand expectations and maintain the right level of certifications.  

The HITRUST Results Distribution System (RDS) makes exchanging results easier and more secure. It helps you manage multiple third-party vendors simultaneously and analyze their results accurately.  

Learn more about how you can make vendor risk management more effective and efficient with HITRUST.  

- Ryan Patrick, VP of Adoption, HITRUST 

Third-Party Risk Management (TPRM) is supposed to be the bedrock of securing organizations from the risks posed by external vendors and business partners, but the current system is fundamentally broken. This becomes painfully clear when we examine three of the most critical pain points: the low quality and variability of SOC 2 reports, the inefficiency of questionnaires, and the lack of reciprocity between governing bodies. 

SOC 2 Reports: A Quality Crisis 

SOC 2 reports are often regarded as the “go-to” standard for assessing the security controls of third-party vendors because of their wide adoption across all industries. Yet, the quality and reliability of these reports can vary dramatically. Some SOC 2s are meticulously detailed and provide actionable insights into a vendor's security posture. However, many others are shallow, missing critical information, or worse, relying on outdated practices that no longer align with today's threat landscape. The control selection is purely up to the organization being assessed. Furthermore, there is a race to the bottom with “SOC in box” firms pencil whipping reports at the lowest cost possible. The variability of these reports erodes trust.  

What is the point of asking for a SOC 2 if you can’t guarantee a consistent standard? SOC 2 reports will remain an unreliable cornerstone in TPRM until there is a way to enforce more uniform, higher-quality reporting. 

The Questionnaire Bottleneck 

The next pain point is the inefficiency of vendor questionnaires. In theory, these should help organizations get a clearer understanding of a vendor’s security practices. In reality, they’ve become a bureaucratic nightmare. Security questionnaires are often long, repetitive, and rarely tailored to the specific risks posed by a particular vendor. Worse yet, vendors receive dozens, sometimes hundreds, of these questionnaires, leading to inconsistent or hurried responses. It’s not uncommon for vendors to send recycled answers that don’t address the nuances of the questions asked. This "checkbox" approach is inefficient for both sides and doesn’t provide the insight to make informed risk decisions. 

It’s even more troubling that the organizations requesting the security questionnaires often lack the time, expertise, or resources to assess the answers they receive thoroughly. Most companies don't have dedicated teams or the specialized knowledge required to interpret the responses and probe deeper into potential vulnerabilities. As a result, the due diligence process often becomes superficial, with organizations relying on incomplete or misunderstood information. Organizations may unwittingly expose themselves to greater vulnerabilities instead of truly mitigating risk.  

Reciprocity Between Governing Bodies: A Missing Link 

One of the biggest systemic failures in TPRM is the lack of reciprocity between governing bodies and frameworks. We have SOC 2, ISO 27001, NIST, and a host of other frameworks, all serving slightly different functions but ultimately aiming at the same goal: reducing risk. However, organizations are forced to undergo multiple, redundant audits and assessments as there’s little reciprocity between these frameworks. Vendors end up in a web of overlapping requirements, increasing the time and cost of compliance without adding meaningful value to security. The industry needs a system of mutual recognition, where frameworks work together to streamline the risk management process, creating a unified standard that works across sectors and regions. 

A Call for Change 

TPRM is in dire need of reform. Although SOC 2s serve a specific purpose within an organization, they were not designed for TPRM and should not be used for this purpose. Questionnaires must become more focused on the relationship between the two organizations and should stop there. Relying on industry-recognized risk-based assessments/certifications and getting rid of questionnaires lead to streamlined processes and reduced risk profiles. Finally, there must be reciprocity and collaboration between governing bodies to eliminate redundant processes and create a more efficient, effective approach to managing third-party risks. 

The current system is broken, but with concerted efforts from industry leaders, governing bodies, and security professionals, we can rebuild TPRM into a process that truly protects organizations without wasting time or resources. 

Organizations live and operate in an interconnected business environment. The security of your organization is not solely dependent on your internal measures. Every vendor you engage with can either bolster your defenses or expose you to significant risks. The potential consequences of a vendor-related security breach can be devastating, impacting not only your organization but also your customers. This is why it is imperative to have an effective vendor risk assessment plan.

Act before it’s late

Vendor risk evaluation is a crucial aspect of a robust security strategy. When even one vendor is compromised, the ripple effects can lead to data breaches, financial losses, and reputational damages. The attack surface expands as businesses increasingly rely on third-party services, making it vital to understand and mitigate these risks early on before they become vulnerabilities.

Stay ahead of emerging threats

HITRUST offers robust solutions to identify and address security gaps for efficient vendor risk assessment. The HITRUST framework stands out due to its cyber threat-adaptive nature. It harmonizes best practices from more than 50 standards, frameworks, and regulations to address all 19 domains of security and risk management.

The HITRUST CSF is a universal, living framework, unlike most compliance frameworks that are updated every three to four years. It is continuously updated and published regularly for constant cyber threat management.

HITRUST uses threat intelligence data to identify new threats and mitigate them. HITRUST’s proactive approach ensures that your organization and its vendors are assessed against the latest cyber threats, offering optimal risk management. HITRUST enables businesses to be proactive rather than reactive, providing a significant advantage in the ever-evolving threat landscape.

Learn how HITRUST stays agile in cyber threat management with its cyber threat-adaptive framework.

Leverage HITRUST assessments for diverse needs

HITRUST understands that one size does not fit all. You may be working with a vendor that’s a newbie in the business and another one that’s a veteran. HITRUST offers three distinct assessment options — e1, i1, and r2 — catering to organizations of different sizes, needs, and risk profiles.

e1 is best suited for vendors that are new or small, possess limited risks, or are looking to achieve a milestone on their journey to a more robust certification. r2 is HITRUST’s most comprehensive security certification perfect for vendors that need to establish the highest level of trust. i1 serves as the ideal bridge between e1 and r2 for service providers with medium risk profiles. Vendors can also move from one assessment type to the other without losing previous work.  

These assessments provide the right type of security assurance, helping organizations to evaluate vendor risks meticulously. HITRUST assessments ensure that all vendors meet stringent security standards.

Build trust and foster strong business relationships

HITRUST helps you reduce the complexity and cost of vendor risk management by streamlining the assessment process and eliminating the need for multiple audits and questionnaires. It improves the transparency and accountability of your vendors. It boosts the confidence and satisfaction of your customers by demonstrating that you and your vendors are committed to protecting their data and privacy.

Beyond security assurance, HITRUST helps organizations and vendors to build trust and establish strong business relationships. It empowers you to foster a secure and trustworthy business environment by ensuring your vendors adhere to high security standards. This mutual trust is essential for long-term success and resilience against cyber threats.

Evaluating vendor risks is not just a best practice; it is a necessity in today’s digital age. HITRUST assessments provide a comprehensive, adaptive, and proactive approach to vendor risk management. Leverage HITRUST’s tailored assessment options to ensure robust security, build trust, and protect valuable data and reputation.

Don’t wait for a breach to occur — evaluate your vendor risks now and secure your organization’s future.

Guest blog by William Ahrens, Director, Mazars USA

HITRUST assessments can be used to reduce the risk of a data breach, achieve cost savings, and avoid threats. An especially compelling use case is for organizations to use the HITRUST framework to assess their third parties.

Data breaches caused by third-party vendors and suppliers have been a significant concern for organizations in recent years due to the complex nature of modern business operations. As it becomes more common for organizations across industries to outsource greater numbers of services, third-party risks are compounded.

Third-party risks

IBM’s Cost of a Data Breach Report 2022 stated that a compromise at a third party or a business partner caused 19% of breaches. The report also explored the impact various factors had on the average cost of a data breach. While the presence of AI, DevSecOps, and Incident Response had positive impacts on lowering costs, compliance failures and the involvement of third parties inflated the costs. In fact, these two were among the highest contributing factors. When organizations can quickly detect a breach and shorten its lifecycle, they can significantly reduce costs and save as much as $1.12 million.

The potential for risk caused by third parties is especially high for hospitals and healthcare organizations due to their interconnected systems and multiple entry points for data access, which increase their attack surfaces and potential vulnerabilities. Healthcare organizations outsource critical processes that give access to PHI and other sensitive data. This makes it essential to reduce third-party risks with practical solutions that provide reliable assurances and greater insights into security practices.

But where to start? Vendors are a diverse group. They range substantially in size, service offering, capability, risk profile, and cyber maturity. It’s no wonder most organizations — especially those in healthcare — struggle with vendor risk management.

Manual, inconsistent approaches are time- and resource-intensive, overtaxing assigned staff with limited bandwidths and competing priorities. Given the large number of third parties, staff members strain to keep up with the high volume of assessments.

Risk-tiering strategy

To effectively address security requirements that are appropriate for each vendor, companies should consider employing a risk-tiering strategy. Vendor risk management programs with a consistent and structured risk analysis process allow organizations to assess vendors based on the risk they present to the business.

Organizations can select the appropriate level of security assurance for each vendor by considering the following.

• What and how much data does the vendor access and process?
• Are there any fourth parties handling the data?
• If the data is compromised, what would be the impact on the business?

Realizing the need, HITRUST offers three certification options to address varying assurance requirements, risk maturity, and business profiles of vendors.

• The HITRUST e1 - 1-year Validated Assessment is ideal for low-risk vendors looking to assure basic foundational cybersecurity.
• The HITRUST i1 - 1-year Validated Assessment offers more coverage than the e1, demonstrating assurance for leading security practices.
• The HITRUST r2 - 2-year Validated Assessment is considered the gold standard in the industry and is ideal for high-risk vendors.

Benefits of the HITRUST CSF

The foundation of HITRUST certifications is its framework, the HITRUST CSF. The HITRUST CSF offers many unique benefits not found within other compliance frameworks.

• Each HITRUST assessment is built on a common framework, which means vendors can move from one assessment to the other without losing previous work. All of the 44 e1 controls are included in the 182 i1 controls, which are included in the r2 controls set.
• The HITRUST CSF leverages current threat intelligence information and is updated regularly. It ensures that the assessed entities are protected against the latest cyber threats with proper controls.
• The HITRUST MyCSF SaaS compliance and risk management tool automatically builds relevant controls and provides consistent mapping to 40+ authoritative sources.
• HITRUST assessments ensure consistency and accuracy as each validated assessment undergoes three independent quality assurance processes from three separate teams.

HITRUST assessments provide transparent reporting of the assessed vendor’s security practices. Unlike other frameworks, HITRUST is prescriptive. With its suite of products and services, HITRUST offers the most comprehensive assurance mechanism and provides an efficient and tiered vendor risk management methodology.

Unlock the full potential of ServiceNow for Third-Party Risk Management (TPRM). In this webinar, HITRUST and Contender Solutions explore how their solutions help organizations enhance security, automate risk management, and streamline compliance in ServiceNow.

Learn how to

• Automate Your TPRM – Reduce manual effort with real-time tracking and centralized data.
• Enhance Security Operations – Explore how Contender’s integrations optimize incident response and cyber resilience within ServiceNow.
• Maximize Efficiency & Compliance – See how HITRUST’s industry-leading security framework integrates seamlessly with ServiceNow to simplify audits and compliance.

Watch now to see how the HITRUST Assessment Xchange app and Contender Solutions can streamline your TPRM assessment process in ServiceNow.

Watch the on-demand recording that will cover the current state of e1 adoption, creative use cases, lessons learned from QA, pricing, market acceptance, and how organizations are leveraging it as a part of their third-party risk management programs.

Ryan George from UPMC and Mike Parisi from Schellman discuss their experience from scoping to certification. 

Speakers

As financial technology (fintech) continues to evolve, third-party vendor risk management for financial institutions has become a mission-critical priority. In a sector where digital services, data-driven solutions, and external partnerships are the norm, overlooking third-party risk can lead to severe regulatory, operational, and reputational consequences.

This blog explores the unique challenges fintech companies face when managing third-party vendors and how adopting a structured, scalable assurance program like HITRUST can turn risk into a strategic advantage.

The importance of TPRM in fintech

The growing dependence on external vendors

Financial cybersecurity has always been a significant matter. Fintech thrives on agility and innovation — often achieved through partnerships with niche technology providers, cloud service vendors, and data analytics firms. This interconnected ecosystem accelerates time to market but also expands the attack surface. Each vendor relationship introduces potential vulnerabilities that can be exploited if not properly managed through a rigorous finance TPRM program.

What’s at stake: Data, compliance, and reputation

Financial institutions deal with sensitive customer data, proprietary algorithms, and regulatory scrutiny. A single third-party breach can expose this data, violate compliance requirements, and damage customer trust. The cost of a security failure is not limited to fines and downtime — it can derail investor confidence, trigger audits, and stunt growth. That’s why third-party risk management in the financial tech industry is essential.

Understanding third-party vendor risk

What qualifies as a third party?

In the financial technology sector, third parties are any external entities — vendors, partners, or service providers — that support critical business operations. This includes cloud infrastructure providers, payment processors, customer support outsourcers, KYC vendors, and even open-source software contributors. Each must be evaluated not only on performance but also on how they manage risk.

Common types of risk in financial technology

Operational risk

When a key vendor experiences downtime or fails to deliver as expected, it can halt operations, delay product releases, and frustrate customers. In a fast-paced industry like fintech, even brief disruptions can carry outsized consequences.

Security and privacy risk

Third parties often require access to sensitive systems or data. If their security posture is weak, it opens the door to breaches, insider threats, or data misuse. Fintechs must ensure vendors align with stringent security and privacy expectations.

Regulatory and compliance risk

Fintechs operate under a complex web of regulations such as GLBA, SOX, and PCI-DSS. Non-compliance by a vendor can trigger violations and fines for the financial institution itself, even if the organization has otherwise maintained compliance.

Fintech-specific TPRM challenges

Fast growth and loose controls

Third-party vendor risk management for financial institutions is critical. Startups and scaling fintechs are often laser-focused on innovation and growth. Risk management may be deprioritized, leading to ad hoc vendor evaluations and inconsistent controls. This reactive approach makes TPRM fragile and unsustainable.

Compliance complexity across jurisdictions

Many fintech companies operate across states and countries, each with distinct regulatory frameworks. Third-party risk management for fintech across these diverse jurisdictions requires a harmonized, auditable approach to compliance.

Cloud-native tech stacks and data sprawl

Fintechs are heavily cloud-based, often relying on multi-cloud or hybrid environments. This increases the complexity of securing data, enforcing consistent controls, and tracking how and where sensitive information is stored, accessed, and shared.

Best practices for managing vendor risk in fintech

Clear vendor classification and risk tiers

Not all vendors carry the same level of risk. Fintechs should categorize vendors based on access levels, data sensitivity, and operational impact. This finance TPRM approach allows for right-sized due diligence and resource allocation.

Build a scalable onboarding and review process

Vendor onboarding should include standardized risk assessments, contract clauses for compliance and security, and clear documentation. Regular reviews must be scheduled based on the vendor’s risk tier — higher-risk vendors require more frequent assessments. Explore our quick guide to TPRM best practices for establishing a scalable process for third-party vendor risk management for financial institutions.

Continuous monitoring of TPRM

Point-in-time assessments are no longer sufficient. Continuous monitoring — enabled through automation and threat intelligence — helps identify changes in vendor risk posture. This proactive stance helps prevent small issues from escalating into crises.

How an assurance program like HITRUST can help

Bringing structure to risk assessment and monitoring

The HITRUST third-party risk management solution offers a comprehensive assurance program that enables tailored risk management based on business needs. It streamlines vendor management and allows organizations to monitor vendor security gaps and remediations. It makes third-party vendor risk management for financial institutions effective and efficient and ensures vendors meet rigorous security and compliance expectations.

Making audits easier with pre-mapped controls

HITRUST's pre-mapped controls to frameworks like ISO, NIST, and PCI-DSS mean fewer gaps and faster audit preparation. Vendors can demonstrate compliance with multiple standards using a single assessment, reducing audit fatigue and increasing credibility with stakeholders. For a deeper dive into optimizing your TPRM strategy, read our blog.

Turning vendor risk into a strategic advantage

Rather than being a burden, effective third-party risk management in financial tech companies can become a differentiator. Demonstrating robust, scalable TPRM builds trust with customers, investors, and regulators. It signals maturity, readiness for growth, and a commitment to responsible innovation.

By adopting the HITRUST TPRM approach, fintech companies gain the structure and confidence to scale securely — protecting data, preserving trust, and accelerating market access.

Learn how HITRUST can help simplify third-party risk management for fintech companies.

If you’re still accepting SOC 2 reports from your vendors as your primary assurance mechanism, it’s time to take another look. SOC 2 was once considered a strong security indicator for many organizations. However, it has now become little more than a check-the-box exercise. 

Why SOC 2 isn’t enough 

The threat landscape has evolved. Data breaches have become harder to detect. Cyberattacks have become more sophisticated. Bad actors are finding new ways to target weak vendors and gain access to sensitive data from multiple organizations. Not just that, ransomware attacks have also increased, disrupting business continuity and causing major reputational and financial damages.     

The problem? SOC 2 has not evolved to tackle these new-age challenges. Instead, it has been trivialized to the point where it no longer signifies robust assurance. 

Automation, inconsistency in auditing practices, and vendor-scoped control selection result in many SOC 2 reports providing limited insight into a vendor’s actual security posture. Often, they also miss critical control areas, like third-party risk management (TPRM) and email security, putting your organization at risk of inherited vulnerabilities. 

In a time of escalating ransomware attacks and increased regulatory scrutiny, the assurance mechanisms you rely on need to do more than just say that your vendor is secure. They need to prove it. 

That’s where HITRUST certification comes in. 

Why HITRUST is a better alternative  

HITRUST offers an effective, standardized approach to vendor risk management.  

Unlike SOC 2, HITRUST  

• Stays ahead of emerging threats with threat intelligence data  

• Uses a comprehensive, prescriptive framework aligned with 60+ standards 

• Delivers proven results as 99.41% of HITRUST-certified environments remained breach-free in 2024 

• Offers scalable assessment options based on business needs and vendor’s risk profile 

• Streamlines managing large volumes of vendors and reduces manual effort 

• Encourages continued risk tracking and remediation  

But what does this mean for your vendor risk management strategy? And how can you adopt this effective TPRM approach? 

To explain this, we’ve created a concise eBook to help you evaluate SOC 2’s limitations and explore why modern organizations are replacing it with HITRUST certification as their new TPRM baseline. 

Read the eBook now to learn more: Why It’s Time to Rethink SOC 2 in Third-Party Risk Management

It’s time to move from traditional, checkbox compliance to proven cybersecurity assurance that can truly reduce risk and help protect your business. Choose HITRUST certification over SOC 2 reports to strengthen your TPRM program.  

One of the most persistent challenges in Third-Party Risk Management (TPRM) is the growing tension between vendors and their customers over how much information is “enough” to complete the vendor due diligence process and gain meaningful assurance. At the heart of this tension is a fundamental friction: vendors are understandably cautious about sharing detailed internal information, while customers are under pressure to demand more of it. 

Vendor caution: Balancing security and disclosure 

For vendors, fear is real. Providing detailed documentation, such as audit reports, penetration test results, or internal security policies, feels like handing over the blueprint to their security house as part of the vendor due diligence process. There’s anxiety that this information could be misused, misinterpreted, weaponized in future business disputes, or maybe lost or breached by the customer. Many vendors worry about loss of control, leaks of sensitive competitive data, or being penalized for perceived gaps taken out of context. 

Customer expectations: Regulatory pressure and risk management 

On the other hand, customers feel the weight of regulatory expectations, board oversight, and real cyber risk. Their job is to protect their organization and to do that effectively, they want as much transparency as possible. Security questionnaires are long, evidence requests are deep, and certification reports are just the starting point. The result? A game of chicken where both parties end up frustrated, and risk assurance is delayed — or worse, superficial. 

This imbalance isn’t sustainable. 

Building a culture of trust: Bridging the gap  

TPRM will not improve unless both sides are willing to meet in the middle and work together. Creating a true partnership requires addressing the core challenges in third-party risk management directly and understanding the need for a balanced approach. Both vendors and customers must share the responsibility for the security and integrity of the information exchanged.  

This means rethinking how organizations define “enough” information for trust. Not everything must be disclosed in raw form. Vendors can offer redacted summaries, attestations from credible third parties, or scoped access under NDA. Customers, meanwhile, must move beyond checkbox audits and begin aligning questions with actual risk, focusing on what truly matters instead of what is easiest to ask.  

Not all controls are created equal. Only a small percentage actually protects against threats today. Customers should focus on those controls and not every control, which is a compliance exercise instead of a security practice. A deep dive into critical security areas, such as incident response protocols, vendor access controls, and data encryption standards, will have a much more meaningful impact than combing through irrelevant, blanket requirements. 

Standardization can also help. Frameworks like HITRUST offer a common language to reduce back-and-forth. By adopting a unified third-party risk management framework, vendors and customers can reduce complexity and avoid unnecessary friction. Frameworks and certifications like HITRUST set clear, actionable security standards that help organizations move beyond the guesswork of ad-hoc risk management practices.

But the real unlock is cultural: mutual respect, shared goals, and clear expectations. When vendors and customers collaborate — not compete — on risk transparency, both sides benefit. Trust is built faster, assurance is stronger, and business moves forward. 

Looking ahead: Embracing partnership for a secure future 

The future of TPRM isn’t more friction. It’s more partnership. As both sides work together to enhance transparency and security, TPRM will evolve into a more proactive and sustainable process.  

Third-party risk management (TPRM) in financial services has become increasingly critical as institutions rely more on external vendors and technology providers to enhance their operational efficiency and innovation capabilities. With the financial sector rapidly adopting new technologies, outsourcing key processes, and integrating complex vendor ecosystems, effective management of third-party risks has become essential. But how exactly is TPRM in finance evolving to address these growing challenges, and how can organizations proactively prepare for the future?

Why TPRM is a growing concern in finance

The expanding vendor ecosystem in financial services

The financial sector’s vendor landscape is rapidly expanding, driven by digital transformation, fintech integrations, and a growing dependency on cloud services. Financial institutions today engage with a broader range of third-party providers than ever before. Each new partnership introduces potential vulnerabilities, underscoring the critical importance of robust third-party risk management in finance.

The business impact of third-party risk failures

Third-party risk failures can lead to significant financial losses, regulatory penalties, and severe reputational damage. Incidents involving vendor breaches or compliance lapses have made headlines, highlighting how crucial effective third-party risk management in financial services is for safeguarding trust and maintaining operational stability. Companies must now consider third-party risks as integral to their strategic planning, with clear procedures and mitigation strategies to prevent and respond to such disruptions.

Regulatory pressures and industry standards

Key regulations shaping third-party risk management

Financial institutions face stringent regulatory requirements designed to enhance oversight and manage risks associated with third-party vendors. Key regulations such as OCC Bulletin 2013-29, FFIEC guidelines, and recent updates from regulatory bodies demand comprehensive vendor management programs. Compliance with these regulations is not merely about avoiding penalties but is integral to the institution’s overall risk management strategy, requiring proactive measures and thorough documentation of third-party activities.

The shift toward continuous compliance and oversight

Regulators increasingly emphasize continuous compliance, transitioning from periodic checks toward real-time monitoring and oversight of third-party engagements. This shift necessitates an agile and robust financial TPRM infrastructure capable of ongoing, real-time analysis, rapid response to anomalies, and timely remediation of any compliance issues that arise.

How regulatory expectations are evolving

Regulatory bodies are consistently pushing financial institutions toward enhanced transparency and accountability. The expectations now extend beyond basic compliance to detailed reporting, comprehensive documentation, and demonstrable oversight of vendor activities, particularly around cybersecurity and data protection. Financial institutions must adapt to these evolving expectations, ensuring their third-party risk management programs are robust, transparent, and continuously evolving.

Core strategies for managing third-party risk effectively

Vendor risk assessments and onboarding due diligence

Effective third-party risk management in finance begins with rigorous vendor risk assessments and comprehensive onboarding due diligence. Institutions must thoroughly evaluate potential vendors’ cybersecurity measures, regulatory compliance history, operational resilience, and financial stability. This proactive approach ensures that partnerships are initiated with full awareness of potential risks, enhancing overall security posture.

Ongoing monitoring and performance reviews

Continuous monitoring and regular performance evaluations of vendors are essential elements of successful TPRM in finance. Organizations must establish systematic processes to detect and mitigate risks promptly, ensuring vendor compliance remains consistently high. Regular reviews enable timely interventions, thereby safeguarding institutional operations and reputation.

Working proactively with vendors to improve security posture

Establishing clear expectations and communication channels

Transparent, consistent communication and clearly defined expectations between financial institutions and their vendors are fundamental to effective TPRM. Establishing communication channels and clear contractual terms helps ensure alignment on security practices, compliance responsibilities, and protocols for incident management, thereby significantly reducing the potential for misunderstandings and vulnerabilities.

Encouraging transparency through shared assessments and reporting

Transparency is a cornerstone of effective third-party risk management in financial services. Encouraging vendors to proactively share security assessments, incident reports, and remediation plans fosters an environment of trust and collaboration. This approach not only enhances the security posture of the organization but also expedites responses to potential threats and vulnerabilities.

The role of technology in scaling risk management

Automation tools for vendor tracking and audits

Automation technologies significantly enhance financial TPRM capabilities by streamlining vendor tracking, conducting comprehensive audits, and automating risk assessments. These tools reduce manual effort, minimize errors, and provide accurate, timely insights into vendor performance, enabling financial institutions to manage extensive and complex vendor networks efficiently.

AI-powered risk scoring and threat detection

AI is revolutionizing third-party risk management through advanced risk scoring, predictive analytics, and real-time threat detection. AI-driven systems quickly identify emerging threats and vulnerabilities, enabling proactive management and timely mitigation actions. Financial institutions leveraging AI benefit from enhanced predictive capabilities, reduced response times, and improved overall risk management effectiveness.

Conclusion: Preparing for what’s next in third-party risk

Why HITRUST is the way forward

The future of third-party risk management in financial services requires comprehensive, adaptive, and industry-trusted assurance programs. HITRUST offers structured assessments and continuous compliance monitoring, ensuring a resilient approach for financial organizations to manage vendor risks effectively.

The value of resilience and trust in vendor relationships

Building resilience and trust in vendor relationships is essential in a landscape marked by complexity and evolving threats. HITRUST certifications help financial institutions exceed regulatory expectations, ensuring long-term security and robust operational compliance.

To learn more about how HITRUST can streamline your organization’s vendor assessments and build lasting trust with stakeholders, visit our third-party risk management page.

Third-Party Risk Management (TPRM) is fundamentally broken. It is supposed to provide visibility and control over vendor-related risks, but in practice, it leaves organizations overwhelmed and vulnerable.

One of the issues plaguing TPRM is remediation failure. Plans of remediation in TPRM often fail to translate into tangible risk reduction, leaving organizations with more exposure than they realize.

The follow-through problem in TPRM

Research indicates that organizations remediate only about 10% of the vulnerabilities they identify each month. This is not just a matter of negligence — it is a systemic failure caused by competing priorities, resource constraints, and an ever-growing vendor ecosystem that is too large to manage effectively. Organizations may have robust assessment processes in place, but they struggle to ensure third-party vendors actually follow through on remediation commitments. This results in a backlog of unmitigated risks that continue to accumulate, leaving organizations exposed to known threats that should have been addressed.

The illusion of risk reduction in vendor management

When vendors report that remediation is complete, organizations often lack the reporting mechanisms to verify and measure these efforts. Without proper tracking and accountability, there is no clear picture of whether remediation efforts have truly reduced risk. The lack of standardized third-party assurance only exacerbates the issue, making it difficult to hold vendors accountable and gain efficient visibility.

For example, a healthcare provider may identify vulnerabilities in a vendor’s remote access system and initiate a remediation plan. However, without structured follow-up through TPRM processes, there is no assurance that the vendor has taken the necessary corrective actions. In some cases, issues marked as “resolved” may persist due to miscommunication, incomplete implementation, or new dependencies that introduce similar vulnerabilities.

The continuous monitoring challenge in TPRM

Continuous monitoring is the ideal solution for ensuring remediation in TPRM that leads to lasting security improvements. By maintaining real-time visibility into third-party cyber risks, organizations can track vulnerabilities, measure remediation progress, and proactively address emerging threats. However, few organizations have the means to achieve this because

• TPRM programs are overwhelmed with too many vendors to monitor effectively.
• Many approaches, such as point-in-time assessments, provide only a partial view of risk.
• There is no universally accepted standard for vendor risk management, making consistency impossible.
• Third-party vendors lack incentives to provide sufficient assurance and transparency.

HITRUST helps address these challenges by providing a standardized and scalable framework for assessing vendor security postures. Unlike traditional compliance checklists, HITRUST ensures that security controls are continuously monitored and validated, offering a more dynamic and reliable approach to vendor risk management. Organizations leveraging HITRUST can enforce accountability through a well-defined and industry-accepted certification process that ensures vendors meet and maintain rigorous security standards.

Bridging the gap: Fixing TPRM to enable effective remediation

Organizations must address the broader failures to turn remediation in TPRM into a reality.

1. Prioritizing critical vendor vulnerabilities: Since remediating all vendor-related vulnerabilities is unrealistic, organizations must focus on those that pose the highest risk. Establishing clear prioritization criteria, based on threat intelligence rather than subjective opinions, ensures the most dangerous threats are addressed first.
2. Standardizing third-party assurance: Vendors must be held to consistent security and remediation standards. HITRUST certification provides a reliable mechanism for verifying vendor security postures, enforcing SLAs around remediation, and requiring real-time reporting on security controls.
3. Enhancing reporting and metrics: Organizations need robust reporting mechanisms that track vendor remediation efforts and their impact on overall risk reduction. HITRUST assurance mechanism helps establish clear, auditable metrics that go beyond self-attested compliance.
4. Simplifying stakeholder engagement: Too many stakeholders slow down remediation efforts. Organizations should streamline vendor management responsibilities and clarify ownership of risk mitigation tasks while leveraging HITRUST’s structured governance approach to simplify oversight.
5. Investing in continuous monitoring capabilities: While achieving true continuous monitoring is difficult, organizations can implement more frequent risk assessments, automated scanning, and real-time alerts to improve visibility into vendor risks. HITRUST integrates continuous monitoring requirements that provide an ongoing assessment of vendor compliance and security effectiveness.

Conclusion

Without structured follow-up, organizations become more vulnerable to third-party cyber risks, often without realizing it. HITRUST offers a viable path forward by providing a standardized and continuously monitored approach to TPRM. Remediation will remain an illusion until organizations adopt structured third-party assurances like HITRUST to address systemic flaws.

Vendor risk management is a cornerstone of safeguarding sensitive data and systems, particularly in sectors like healthcare, where protecting patient information is crucial. Despite best efforts, significant blind spots often remain in vendor risk assessments. These vulnerabilities stem from incomplete vendor inventories, prioritization challenges, and a lack of visibility into downstream risks. Understanding and addressing these gaps is critical to bolstering enterprise security.

The scope of the problem

Most organizations struggle to achieve full visibility across their vendor portfolio. Risk assessments often cover only a small fraction of the total number of vendors servicing the organization. This limited scope is largely driven by difficulties in accurately identifying all vendors and the necessity to focus resources on those perceived as most critical. Consequently, vendors that are not deemed mission-critical or high-risk are often overlooked, leaving hundreds of vendors unassessed. This creates significant blind spots, especially in a healthcare environment where even low-risk vendors could inadvertently compromise patient data or systems.

Fourth-party risks amplify the challenge

The problem extends beyond third-party vendors to the broader supply chain. The emergence of vulnerabilities and breaches in fourth-party products and services, such as the Log4j vulnerability, the SolarWinds attack, and the Okta compromise, underscores the cascading risks organizations face. These incidents highlight a troubling reality: many third-party vendors do not maintain accurate inventories of their own supply chain products. This lack of transparency means organizations are often unaware of their exposure to downstream vulnerabilities.

For example, a vendor may rely on a software library that contains a critical vulnerability, yet this dependency remains unreported or undiscovered. In such cases, organizations are blind to the risks posed to their critical data and applications, compounding the difficulty of implementing effective remediation strategies.

Prioritization and risk triage fall short

When faced with limited resources, organizations understandably prioritize vendors based on criticality. Mission-critical vendors and those presenting the highest inherent risks receive the most attention. However, this approach leaves out less obvious forms of risk that can still have significant consequences.

For instance, vendors with remote access to systems, those with physical access to facilities, or those managing privileged accounts might not be classified as critical but can still introduce substantial vulnerabilities. These forms of access can be exploited by malicious actors to bypass traditional security measures, emphasizing the need for a broader view of what constitutes risk.

Addressing the blind spots

To mitigate these gaps, organizations must adopt a more comprehensive and dynamic approach to vendor risk management. Here are some key strategies.

1. Develop a comprehensive vendor inventory: Organizations need complete and accurate inventory of all vendors servicing their operations. This requires cross-departmental collaboration and the use of automated tools to identify and catalog vendors.
2. Enhance visibility into fourth-party risks: Working with third-party vendors to improve transparency in their supply chains is critical. Organizations should mandate that vendors maintain detailed inventories of their own dependencies and report any vulnerabilities promptly.
3. Adapt assessments based on threat intelligence: Incorporating real-time threat intelligence into vendor assessments allows organizations to adapt risk evaluations based on the latest cyber threat landscape. This approach ensures that assessments account for emerging vulnerabilities, attack vectors, and threat actors targeting specific industries or systems. Organizations can identify which vendors are most susceptible to active threats and prioritize remediation efforts by leveraging threat intelligence.
4. Leverage technology and automation: Advanced risk management platforms can help organizations streamline vendor assessments, prioritize risks more effectively, and monitor for vulnerabilities in real time. Automation can also reduce the burden on internal teams, enabling them to focus on higher-value tasks.
5. Adopt continuous monitoring: Risk management cannot be a one-time effort. Continuous monitoring of vendors, their supply chains, and emerging vulnerabilities is essential for maintaining an up-to-date risk profile.
6. Foster collaborative risk mitigation: Establishing strong partnerships with vendors can lead to more proactive risk mitigation. Vendors should be treated as extensions of the organization’s security ecosystem, with clear expectations for compliance and risk management practices.

Conclusion

The blind spots in vendor risk assessments present significant challenges to enterprise security, particularly in high-stakes environments like healthcare. By addressing gaps in vendor inventories, improving visibility into fourth-party risks, and expanding risk assessment criteria, organizations can enhance their resilience against emerging threats. While the task may seem daunting, a proactive and collaborative approach can transform vendor risk management from a reactive necessity into a strategic advantage.

The digital transformation of healthcare has unlocked incredible opportunities to improve patient care and operational efficiency. However, it has also exposed a critical flaw in how third-party risk management (TPRM) is done across the industry.

As digital health technologies proliferate, so do the challenges for security teams tasked with vetting vendors. The traditional questionnaire-based vendor assessment model was long considered the gold standard for due diligence, but it is struggling to keep pace with the volume and complexity of today’s supply chains.

The chokepoint in the procurement process

Healthcare organizations rely on a vast ecosystem of vendors to power everything from telemedicine platforms to electronic health records. But with great reliance comes great responsibility: these vendors must be thoroughly vetted to ensure they won’t introduce vulnerabilities into the organization.

The sheer volume of vendors is overwhelming security teams. Requests for security due diligence assessments are coming in faster than they can be completed, creating a backlog that frustrates internal business owners waiting to onboard critical technologies.

This bottleneck not only slows innovation but also prevents teams from reassessing critical vendors as their technology evolves and threats change.

The vendor's perspective: A broken model

The challenges aren’t limited to healthcare providers. Vendors in the supply chain are equally overwhelmed by the inefficiencies of the current system. Every prospective customer requires some form of security due diligence, and there’s no industry-wide standardization.

Vendors often face

• Inconsistent questionnaires: Each customer has unique expectations, making it impossible to standardize responses.
• Moving goalposts: Security requirements vary widely across healthcare entities, leading to confusion and delays.
• Resource constraints: Vendors with finite security teams struggle to keep up with the growing volume of audits, leaving customers dissatisfied and deals unfinished.

The result is a broken system that delays procurement, frustrates both parties, and introduces unnecessary risk.

Reassessments: The forgotten priority

Adding to the complexity is the need to reassess critical vendors over time. Technology and threats evolve rapidly, and a vendor’s security posture today might not be the same six months from now. However, most security teams are so bogged down with initial assessments that they don’t focus on reassessments. This creates a dangerous gap in visibility and increases the likelihood of vulnerabilities slipping through the cracks.

How do we fix it?

If the traditional TPRM model is broken, how can we rebuild it? Here are a few key strategies.

1. Automate where possible

Leverage tools and platforms that automate aspects of vendor assessments, such as real-time monitoring of security postures, to reduce reliance on static questionnaires.

2. Adopt industry standards

HITRUST, with its risk- and threat-based approaches to security and compliance, provides a framework that can alleviate many of these challenges. Healthcare organizations and vendors can reduce inefficiencies and build a more robust TPRM program by leveraging HITRUST as a standardized assessment mechanism.

3. Join industry collaborators

The Health 3rd Party Trust (Health3PT) Initiative is a proactive group committed to reducing third-party information security risk with more reliable and efficient assurances. It has been established to evaluate, identify, and implement actionable and practical solutions that healthcare organizations can adopt to provide more reliable assurances, consistent information security program reporting, and better visibility into downstream relationships with third parties.

4. Implement continuous monitoring

Use continuous monitoring to track vendors’ security practices over time instead of relying solely on one-time assessments. This approach ensures risks are identified and addressed as they arise.

5. Enhance collaboration

Foster open communication between vendors and healthcare organizations to set clear expectations and establish mutual trust.

The path forward

Vendor risk management is at a breaking point in healthcare, but it doesn’t have to stay that way. We can reduce the burden on security teams and vendors alike by embracing automation, standardization, and continuous monitoring. Most importantly, we can create a TPRM program that balances efficiency with the need for robust security, ensuring that healthcare organizations can innovate safely while protecting patient data and trust.

The time for change is now. Let’s stop letting TPRM be a chokepoint and start using it as a competitive advantage.

Due diligence and security questionnaires have become staples of the vendor risk assessment process for third-party risk management (TPRM). However, as the cybersecurity landscape evolves, our tools must evolve, too. Due diligence questionnaires remain a necessary component but the overreliance on static security questionnaires has become a barrier to effective risk management.

The value of due diligence questionnaires

Due diligence questionnaires are designed to answer critical, relationship-specific questions.

• Scope of engagement: What data, systems, or services will the third party access?
• Compliance requirements: Are specific legal, regulatory, or contractual obligations tied to this relationship?
• Business impact: What is the potential operational or reputational risk if this third party is compromised?

These questions go beyond generic cybersecurity concerns, focusing on the unique aspects of the partnership. They help organizations understand the relationship and ensure that appropriate safeguards align with its specifics. Due diligence questionnaires are a necessary foundation for establishing trust and setting expectations.

The problem with security questionnaires

Security questionnaires often fall short. These standardized forms ask third parties to provide detailed information about their cybersecurity practices.

• How do they handle encryption?
• Do they’ve had recent audits?
• What are their incident response protocols?

While these are important topics, the format of traditional questionnaires introduces several issues.

1. Static and stale data

Security questionnaires provide a snapshot in time that quickly becomes outdated. A vendor might submit a completed questionnaire today, but their environment, controls, or threat landscape could change tomorrow.

2. Lack of context

These forms are often disconnected from the specifics of the relationship. For example, knowing that a vendor uses encryption is less relevant if the relationship doesn’t involve handling sensitive data.

3. Inefficiency

Completing and reviewing lengthy questionnaires is time-consuming for both parties, creating bottlenecks that slow down procurement and vendor risk assessments.

4. Checkbox mentality

Organizations may treat completed questionnaires as a substitute for meaningful engagement, creating a false sense of security without truly understanding the risks.

5. Expertise of analysts

Questionnaires are typically developed by the staff at the requesting organization. The staff may lack the expertise to evaluate control selection or even the ability to interpret the results/responses to the questions.

A better approach to TPRM

To move forward, organizations must reimagine the role of questionnaires in TPRM.

1. Use due diligence for context

Focus on due diligence to capture relationship-specific insights. These questions matter most for tailoring your risk management approach to the specific vendor or partner.

2. Replace static questionnaires with dynamic assessments

Instead of relying on static forms, leverage real-time threat intelligence, continuous monitoring, and assessments that incorporate threat data into the control selection to understand a vendor’s security posture.

3. Focus on collaboration, not compliance

Engage with third parties to address risks collaboratively. Move beyond filling out forms to having meaningful discussions about risks, mitigations, and shared goals.

4. Streamline where possible

Adopt frameworks and framework bodies that actively collaborate on reciprocity to reduce redundancy and streamline the process for vendors managing multiple client requests.

The bottom line

Due diligence questionnaires remain a vital part of TPRM because they provide relationship-specific details needed to assess and manage risks effectively. Security questionnaires, however, need a modern overhaul. By transitioning from static, checklist-driven approaches to dynamic, real-time methods, organizations can focus on what truly matters: building resilient partnerships that mitigate risks and enable business growth.

It’s time to retire the outdated questionnaire model and embrace a more effective, efficient, and adaptive approach to TPRM. After all, managing third-party risks isn’t about ticking boxes — it’s about protecting your organization in an interconnected world.

How often do you rely on a third-party vendor to conduct a business function? Every day or, perhaps, every hour?  

Third-party vendors are an integral part of a business. Organizations rely on them for many services, from processing payments to providing hardware and automating operations. If your organization is growing, your number of vendors is growing, too.  

But have you thought this indeed increases your data exposure? 

Third-party vendors increase cyber risks 

Your risk amplifies as more and more third parties access your systems and data. These vendors use your sensitive data to perform critical business functions. However, if any of these vendors is breached, attackers can gain direct access to your business data and misuse information about your customers and employees.  

So, how do you ensure your vendors have strong security programs before giving them access to sensitive data?  

Third-party risk assessment is crucial to identifying the strengths and weaknesses of your vendors’ security programs. Traditionally, organizations have used multiple tools and tactics to evaluate third-party risks. But these tactics are far from being effective.  

Cybersecurity questionnaires have been one of the popular tactics. Questionnaires are tedious and unreliable. They consume a lot of staff hours, refraining your teams from focusing on more critical tasks. If your teams send out questionnaires, they spend hundreds of hours coordinating with vendors, evaluating answers, and following up on incomplete responses. Furthermore, there is no accurate way of verifying the information provided by the vendors in the questionnaires.  

Organizations need a better third-party risk management (TPRM) program, and that’s why they choose HITRUST.  

HITRUST helps organizations demonstrate trust  

HITRUST offers reliable assurances that are based on its framework, HITRUST CSF. The HITRUST CSF harmonizes best practices from more than 50 authoritative sources. It is widely accepted and transparent as it allows you to verify the sources of the controls. The cyber threat-adaptive HITRUST CSF is updated regularly to help you protect against upcoming threats.  

Not all your vendors need to undergo the comprehensive HITRUST r2 assessment. Based on their needs, size, and risk profiles, HITRUST offers different assessment options. The HITRUST e1 is suited for small vendors or those with limited inherent risks. It also serves as the ideal option for vendors looking to demonstrate a milestone on their journey to a more robust certification. HITRUST i1 is best for mid-level vendors looking for an assessment between the basic e1 and the extensive r2.   

HITRUST makes vendor risk management efficient 

HITRUST offers additional solutions to make vendor risk management efficient. The HITRUST Assessment XChange coordinates with vendors to track assessments and Corrective Action Plans (CAPs) so you don’t have to worry about exchanging hundreds of emails and phone calls. It helps your vendors understand expectations and maintain the right level of certifications.  

The HITRUST Results Distribution System (RDS) makes exchanging results easier and more secure. It helps you manage multiple third-party vendors simultaneously and analyze their results accurately.  

Learn more about how you can make vendor risk management more effective and efficient with HITRUST.  

- Ryan Patrick, VP of Adoption, HITRUST 

Third-Party Risk Management (TPRM) is supposed to be the bedrock of securing organizations from the risks posed by external vendors and business partners, but the current system is fundamentally broken. This becomes painfully clear when we examine three of the most critical pain points: the low quality and variability of SOC 2 reports, the inefficiency of questionnaires, and the lack of reciprocity between governing bodies. 

SOC 2 Reports: A Quality Crisis 

SOC 2 reports are often regarded as the “go-to” standard for assessing the security controls of third-party vendors because of their wide adoption across all industries. Yet, the quality and reliability of these reports can vary dramatically. Some SOC 2s are meticulously detailed and provide actionable insights into a vendor's security posture. However, many others are shallow, missing critical information, or worse, relying on outdated practices that no longer align with today's threat landscape. The control selection is purely up to the organization being assessed. Furthermore, there is a race to the bottom with “SOC in box” firms pencil whipping reports at the lowest cost possible. The variability of these reports erodes trust.  

What is the point of asking for a SOC 2 if you can’t guarantee a consistent standard? SOC 2 reports will remain an unreliable cornerstone in TPRM until there is a way to enforce more uniform, higher-quality reporting. 

The Questionnaire Bottleneck 

The next pain point is the inefficiency of vendor questionnaires. In theory, these should help organizations get a clearer understanding of a vendor’s security practices. In reality, they’ve become a bureaucratic nightmare. Security questionnaires are often long, repetitive, and rarely tailored to the specific risks posed by a particular vendor. Worse yet, vendors receive dozens, sometimes hundreds, of these questionnaires, leading to inconsistent or hurried responses. It’s not uncommon for vendors to send recycled answers that don’t address the nuances of the questions asked. This "checkbox" approach is inefficient for both sides and doesn’t provide the insight to make informed risk decisions. 

It’s even more troubling that the organizations requesting the security questionnaires often lack the time, expertise, or resources to assess the answers they receive thoroughly. Most companies don't have dedicated teams or the specialized knowledge required to interpret the responses and probe deeper into potential vulnerabilities. As a result, the due diligence process often becomes superficial, with organizations relying on incomplete or misunderstood information. Organizations may unwittingly expose themselves to greater vulnerabilities instead of truly mitigating risk.  

Reciprocity Between Governing Bodies: A Missing Link 

One of the biggest systemic failures in TPRM is the lack of reciprocity between governing bodies and frameworks. We have SOC 2, ISO 27001, NIST, and a host of other frameworks, all serving slightly different functions but ultimately aiming at the same goal: reducing risk. However, organizations are forced to undergo multiple, redundant audits and assessments as there’s little reciprocity between these frameworks. Vendors end up in a web of overlapping requirements, increasing the time and cost of compliance without adding meaningful value to security. The industry needs a system of mutual recognition, where frameworks work together to streamline the risk management process, creating a unified standard that works across sectors and regions. 

A Call for Change 

TPRM is in dire need of reform. Although SOC 2s serve a specific purpose within an organization, they were not designed for TPRM and should not be used for this purpose. Questionnaires must become more focused on the relationship between the two organizations and should stop there. Relying on industry-recognized risk-based assessments/certifications and getting rid of questionnaires lead to streamlined processes and reduced risk profiles. Finally, there must be reciprocity and collaboration between governing bodies to eliminate redundant processes and create a more efficient, effective approach to managing third-party risks. 

The current system is broken, but with concerted efforts from industry leaders, governing bodies, and security professionals, we can rebuild TPRM into a process that truly protects organizations without wasting time or resources. 

Organizations live and operate in an interconnected business environment. The security of your organization is not solely dependent on your internal measures. Every vendor you engage with can either bolster your defenses or expose you to significant risks. The potential consequences of a vendor-related security breach can be devastating, impacting not only your organization but also your customers. This is why it is imperative to have an effective vendor risk assessment plan.

Act before it’s late

Vendor risk evaluation is a crucial aspect of a robust security strategy. When even one vendor is compromised, the ripple effects can lead to data breaches, financial losses, and reputational damages. The attack surface expands as businesses increasingly rely on third-party services, making it vital to understand and mitigate these risks early on before they become vulnerabilities.

Stay ahead of emerging threats

HITRUST offers robust solutions to identify and address security gaps for efficient vendor risk assessment. The HITRUST framework stands out due to its cyber threat-adaptive nature. It harmonizes best practices from more than 50 standards, frameworks, and regulations to address all 19 domains of security and risk management.

The HITRUST CSF is a universal, living framework, unlike most compliance frameworks that are updated every three to four years. It is continuously updated and published regularly for constant cyber threat management.

HITRUST uses threat intelligence data to identify new threats and mitigate them. HITRUST’s proactive approach ensures that your organization and its vendors are assessed against the latest cyber threats, offering optimal risk management. HITRUST enables businesses to be proactive rather than reactive, providing a significant advantage in the ever-evolving threat landscape.

Learn how HITRUST stays agile in cyber threat management with its cyber threat-adaptive framework.

Leverage HITRUST assessments for diverse needs

HITRUST understands that one size does not fit all. You may be working with a vendor that’s a newbie in the business and another one that’s a veteran. HITRUST offers three distinct assessment options — e1, i1, and r2 — catering to organizations of different sizes, needs, and risk profiles.

e1 is best suited for vendors that are new or small, possess limited risks, or are looking to achieve a milestone on their journey to a more robust certification. r2 is HITRUST’s most comprehensive security certification perfect for vendors that need to establish the highest level of trust. i1 serves as the ideal bridge between e1 and r2 for service providers with medium risk profiles. Vendors can also move from one assessment type to the other without losing previous work.  

These assessments provide the right type of security assurance, helping organizations to evaluate vendor risks meticulously. HITRUST assessments ensure that all vendors meet stringent security standards.

Build trust and foster strong business relationships

HITRUST helps you reduce the complexity and cost of vendor risk management by streamlining the assessment process and eliminating the need for multiple audits and questionnaires. It improves the transparency and accountability of your vendors. It boosts the confidence and satisfaction of your customers by demonstrating that you and your vendors are committed to protecting their data and privacy.

Beyond security assurance, HITRUST helps organizations and vendors to build trust and establish strong business relationships. It empowers you to foster a secure and trustworthy business environment by ensuring your vendors adhere to high security standards. This mutual trust is essential for long-term success and resilience against cyber threats.

Evaluating vendor risks is not just a best practice; it is a necessity in today’s digital age. HITRUST assessments provide a comprehensive, adaptive, and proactive approach to vendor risk management. Leverage HITRUST’s tailored assessment options to ensure robust security, build trust, and protect valuable data and reputation.

Don’t wait for a breach to occur — evaluate your vendor risks now and secure your organization’s future.

Guest blog by William Ahrens, Director, Mazars USA

HITRUST assessments can be used to reduce the risk of a data breach, achieve cost savings, and avoid threats. An especially compelling use case is for organizations to use the HITRUST framework to assess their third parties.

Data breaches caused by third-party vendors and suppliers have been a significant concern for organizations in recent years due to the complex nature of modern business operations. As it becomes more common for organizations across industries to outsource greater numbers of services, third-party risks are compounded.

Third-party risks

IBM’s Cost of a Data Breach Report 2022 stated that a compromise at a third party or a business partner caused 19% of breaches. The report also explored the impact various factors had on the average cost of a data breach. While the presence of AI, DevSecOps, and Incident Response had positive impacts on lowering costs, compliance failures and the involvement of third parties inflated the costs. In fact, these two were among the highest contributing factors. When organizations can quickly detect a breach and shorten its lifecycle, they can significantly reduce costs and save as much as $1.12 million.

The potential for risk caused by third parties is especially high for hospitals and healthcare organizations due to their interconnected systems and multiple entry points for data access, which increase their attack surfaces and potential vulnerabilities. Healthcare organizations outsource critical processes that give access to PHI and other sensitive data. This makes it essential to reduce third-party risks with practical solutions that provide reliable assurances and greater insights into security practices.

But where to start? Vendors are a diverse group. They range substantially in size, service offering, capability, risk profile, and cyber maturity. It’s no wonder most organizations — especially those in healthcare — struggle with vendor risk management.

Manual, inconsistent approaches are time- and resource-intensive, overtaxing assigned staff with limited bandwidths and competing priorities. Given the large number of third parties, staff members strain to keep up with the high volume of assessments.

Risk-tiering strategy

To effectively address security requirements that are appropriate for each vendor, companies should consider employing a risk-tiering strategy. Vendor risk management programs with a consistent and structured risk analysis process allow organizations to assess vendors based on the risk they present to the business.

Organizations can select the appropriate level of security assurance for each vendor by considering the following.

• What and how much data does the vendor access and process?
• Are there any fourth parties handling the data?
• If the data is compromised, what would be the impact on the business?

Realizing the need, HITRUST offers three certification options to address varying assurance requirements, risk maturity, and business profiles of vendors.

• The HITRUST e1 - 1-year Validated Assessment is ideal for low-risk vendors looking to assure basic foundational cybersecurity.
• The HITRUST i1 - 1-year Validated Assessment offers more coverage than the e1, demonstrating assurance for leading security practices.
• The HITRUST r2 - 2-year Validated Assessment is considered the gold standard in the industry and is ideal for high-risk vendors.

Benefits of the HITRUST CSF

The foundation of HITRUST certifications is its framework, the HITRUST CSF. The HITRUST CSF offers many unique benefits not found within other compliance frameworks.

• Each HITRUST assessment is built on a common framework, which means vendors can move from one assessment to the other without losing previous work. All of the 44 e1 controls are included in the 182 i1 controls, which are included in the r2 controls set.
• The HITRUST CSF leverages current threat intelligence information and is updated regularly. It ensures that the assessed entities are protected against the latest cyber threats with proper controls.
• The HITRUST MyCSF SaaS compliance and risk management tool automatically builds relevant controls and provides consistent mapping to 40+ authoritative sources.
• HITRUST assessments ensure consistency and accuracy as each validated assessment undergoes three independent quality assurance processes from three separate teams.

HITRUST assessments provide transparent reporting of the assessed vendor’s security practices. Unlike other frameworks, HITRUST is prescriptive. With its suite of products and services, HITRUST offers the most comprehensive assurance mechanism and provides an efficient and tiered vendor risk management methodology.