As an IT auditor, part of my job duties includes vendor risk assessment / conducting security due diligence.

Based on documentation obtained from the vendor, (SOC 2 report, SIG survey ) , I and several members of the team, (I am the lead of the team) have concerns that represent be potential security vulnerabilities. Specific concerns:

  • Uses SSL encryption - Did not mention whether this refers to the insecure SSL protocol itself, or the broader suite of technology known as SSL that includes TLS. The SSL is used for remote access by the employees of the vendor and to customer facing web - portal. In the SOC 2 report, it was described by the management of the vendor.

  • Logical access is removed timely upon notification of termination. - Never defined what is the SLA for timely. A specific statement such as logical access is removed within 24 hours or 3 days of termination would have been ideal. This vendor has access to sensitive company data, so no concrete SLA is concerning.

Our team is responsible for advising management on whether to continue to engage with this vendor, and our recommendation will be taken heavily considered. The definition of vulnerability I am using is from NIST as

"Weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source."

If engaging the vendor has not been fruitful, how should such potential vulnerabilities, o weaknesses in security controls, be best reported? On one hand, I do not want to mislead by reporting that the vendor is more secure than evidence suggests, but on the other hand, I do not to unnecessarily write off a vendor simply due to an unfortunate choice of words on the part of the vendor.

  • Your question is too general for a direct answer. It all depends on the exact infrastructure you have. In the vendor's case, why not compare their offers and choose the most secure and balanced for your needs solution ?
    – Overmind
    Commented Jul 5, 2017 at 11:42

1 Answer 1


Is hard to answer your question, because you did not provide enough context from the report.

As for access termination, timely should comply with your internal security policy (termination of employee procedure) where a period of time is defined during which access for the former employees is being revoked. There cannot be an SLA for that.

As for SSL encryption, which part of repot does it come from? Is there a list of systems/services with enabled SSL encryption?

It seems to me that you are looking at summary of the report, which includes key findings only. You should contact your security vendor to clarify these issues, if you do not understand them or ask for a full version of the report.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .