Third Party Risk Management Goes Both Ways: Cybersecurity As Part of Sales Pipeline

When I talk to management to explain what the cybersecurity regulation means for our vendor management practices, it takes no time for them to grasp security reviews. From there, it is an easy step to show them how a vendor holding certifications and audit reports makes the review simple: you ask for the certifications and audit reports, and you skip auditing their practices, asking what their policies are, and so on.

What I am afraid is escaping their attention is that this applies to us too. It is not far off that our customers will start doing vendor reviews on us — which means cybersecurity certifications will come into play on our customers’ side as well. Suddenly, our lack of certifications will become a bottleneck in our sales pipeline.

For a company that has floated thus far without these requirements, convincing management to submit to a certification process requires some justification. There are many good reasons to establish an information security management system and document it with a certification, but this adds a more practical one: all of a sudden, cybersecurity is a prerequisite for closing deals.