OUR APPROACH
Our team of experts work hand-in-hand with you to manage your vendor portfolio and realize vendor risk reduction at scale.
What You Can Expect Working With CORL
- Daily interaction
- Weekly status calls
- Quarterly executive reviews
- High-touch engagement
- Dedication to customer service and quality
CORL’S ASSESSMENT PROCESS GETS RESULTS
OUR EXPERT TEAM DELIVERS QUALITY AND SCALES YOUR PROGRAM
- Research Vendor Security Information
- Monitor Vendors for Security Posture Changes
- Analyze Data for Industry Trends
- Understand Risk to Client
- Present Risk Management Strategy
- Manage Outcomes and Deliver Results
- Audit Evidence Against Standards
- Analyze Vendor and Product Security
- Measure and Monitor Against SLAs
- Perform Quality Review
- Ensure VRM Process Integrity
- Track Remediation
- Support Process & Client
- Communicate with Vendor & Teams
OUR WORKFLOW ENGINE INTEGRATES WITH YOUR PROCESSES AND TOOLS
TO SUPERCHARGE YOUR PROGRAM
- Tier vendors based on risk
- Use risk to determine assessment frequency and scopes
- Determine extent and timing of assessments
- Focus assessment where assurance is required
- Don't gather data for data's sake
- Objective and data driven results
- Benchmark formation
- Data to determine trends and patterns amongst vendor practices
- Strategic remediation strategy versus vendor by vendor designed remediation
- Proactively identify changes to vendor risk posture
- Documented commitments
- Assurance that commitments are met
- Risk posture and remediation process
- Business stakeholder, executive management and board level reporting
DASHBOARD REPORTING TO SUPPORT DECISIONS
AND COMMUNICATION WITH THE BUSINESS
FEATURED RESOURCES
The high value portion of the CORL VRM program is the follow through to completion. We didn’t have the time or resources to dig deep into the issues found. I see value in the CORL's organized approach: listing out remediation items; communicating with our vendors; then following-up with our vendors to dig into compensating controls, evidence of policy, etc.
CORL is extremely valuable because a) you provide a service we would have a hard time doing ourselves as a small shop. You are an FTE augmentation, and I consider you my employees working on my behalf, so CORL becomes my team of ~100 people, and b) the CORL methodology and the thoroughness is very much in tune with my background in the financial services industry, where I built third-party assessment programs.
CORL is a ‘force multiplier’ for our InfoSec Program. It is not possible for us to accomplish at this level, with this amount of efficiency, on our own. Even if we had an FTE... It would take a year or more, where CORL can do it in a month. We cannot reproduce this in-house.