Getting started with Third-Party Risk Scoring

Moraph resells, implements and runs BitSight to monitor the security posture of your vendors and other third parties between assessments. BitSight rates each organization from externally observable evidence and alerts when a rating or finding changes; Moraph sets up your vendor portfolio, triages the alerts, follows up material findings with the relationship owner, and reports on the portfolio. Your third-party risk team decides what a finding means for the relationship.

What it is for

Most third-party risk programs assess vendors through questionnaires and document reviews at onboarding and then once a year or less. Between reviews, a vendor can expose a vulnerable service, show signs of compromised machines or suffer a breach, and the institution hears about it from the news or not at all. Teams that buy security ratings often find they lack the people to watch the alerts, check whether a finding is real, and chase it with the vendor, so the subscription becomes a dashboard nobody acts on.

• Vendor security is assessed periodically, leaving long gaps between reviews
• Breaches and exposures at vendors are learned about late
• Rating alerts arrive faster than the team can check and follow them up
• Examiners expect ongoing monitoring proportionate to each vendor's criticality

Who uses it

• Third-party and vendor risk management teams at banks, credit unions, broker-dealers and insurers
• Chief information security officers and security teams who assess vendor security
• Business owners of critical vendor relationships
• Procurement and contract teams who need risk input at onboarding and renewal
• Risk committees, internal audit and examiners

Before you start

• Your organization uses Third-Party Risk Scoring as a managed platform from Moraph, under an agreement that covers it.
• Licences for BitSight, bought through Moraph or under your own agreement with the vendor.
• A Moraph account in your organization for each person who works with Moraph on the service.
• Named technical and security contacts, recorded in the Moraph Portal.

Steps to get started

1. Agree the scope of the managed service for Third-Party Risk Scoring with Moraph, including which environments and teams it covers.

2. Name your administrators, technical contact and security contact in the Moraph Portal under People and access.

3. Review the configuration baseline Moraph proposes for your regulations, and record any changes you need.

4. Confirm how users will sign in, through your identity provider where the platform supports it.

5. Agree the pilot group and the cut-over plan with your Moraph delivery lead.

Where to go next

• Onboard Third-Party Risk Scoring
• Everyday tasks
• Connect your systems
• Security, data and compliance
• Troubleshooting and the support guide
• Product overview on moraph.com