Does anyone know of a 3rd party vendor risk *monitoring* or *verification* tool?

👋 Hi guys! Does anyone here use a tool that actually checks for things like MFA, password reset policies, SSO, data encryption policies programatically?

For example, if a vendor claims that they have MFA enabled for all of their accounts, I have no way to check their settings myself during the procurement process. I can ask them, but they can lie.

I know there are a few tools that are form builders & CRM's for the vendor risk analysis process, but I'm not aware of any tools that let me verify or monitor a vendors compliance myself.

If theres nothing automated like I'm describing, then what are you currently doing to fact check the claims made in these certs/reports (eg. ISO 27001, SOC II, etc)? submitted by /u/marksalpeter
[link] [comments]


http://dlvr.it/T1kSf5