Vendor Site Audit

Approach

• Customizing the site visit audit scope/criteria to fit a particular client’s needs
• Breaking the site visits into geographical zones for travel efficiencies
• Creating a project plan to schedule the necessary resources
• Coordinating an on-site interview schedule with the key personnel at the vendor to ensure accessibility and availability
• Conducting site visit wrap up meetings with the vendor’s management team and the client
• Generating reports based upon the approved scope and the findings identified

What It Includes

During a site visit, our team will meet all key vendor personnel, perform physical walkthroughs of the facility, inspect documents (i.e. business continuity plan, incident response policies, penetration testing reports, etc.) and perform audit tests in line with the site visit audit scope/criteria. Any findings identified during our procedures will be communicated to both the client and the vendor’s management team. We will issue a report for each site visit.

The scope of our site visits is customizable by client, and can include, but is not limited to:

• Physical security
• Environmental controls (i.e. power generators, fire suppressions, etc.)
• Business continuity planning
• Cyber resilience (Information security, penetration testing results, incident response planning, etc.)
• Vendor management (how the vendor monitors its vendors)
• Logical security (access to key applications and the network)
• Application change management
• Infrastructure change management
• Risk management
• Insurance coverage
• Management oversight and monitoring