Scary Consequences of an Incomplete Vendor SOC Assessment

Podcast Transcript

Hi – my name is Des with Venminder. 

In this 90-second podcast, you’re going to learn about the scary consequences of not performing a thorough assessment of your vendor’s SOC report.

At Venminder, we have a team of information security experts, such as CISSPs, who assess vendor SOC reports every day.

What’s really at stake if something’s overlooked in a SOC report, or worse yet, no SOC assessment is performed? Here are three big consequences: 

1. First, red flags and concerns may go undetected. It’s important to catch cybersecurity issues early to give you more time to address the potential deficiencies. Words like “inadequate,” “unqualified” or “misrepresentation” within the Service Auditor’s Report section of any SOC report can be quick indicators that something is wrong with your vendor’s control environment.

2. Second, you may not notice that your vendor has missed key information security controls, putting your organization at risk. And if controls aren’t adequate, or missed altogether, you’ll need to request your vendor beef up their processes and strengthen internal controls.

3. Third, you won’t be aware of your OWN complementary user entity controls requirements. CUECs are critical and should be outlined in your vendor SOC reports. These are the controls that your organization needs to implement in order to assist the vendor in maintaining a secure environment. If these are neglected and something goes wrong, you may be held accountable for not having proper controls in effect.

There you have it, review your vendor SOC reports thoroughly and avoid these expensive SOC consequences which can include a data breach. Overlooking faulty security controls and missing your own control requirements, can lead to increased risk to your organization’s infrastructure and your customers’ information.

Thanks for tuning in; catch you next time!