Physical Validation Overview

Question 1

Overview

Answer 1

1. Physical Validation Objectives
2. Risk-Based Approach
3. Program Design and Scope
4. When to Perform an Onsite

*Gold standard of due diligence.
-The difference between asking if the room is clean vs. checking to see if the room is clean.

Question 2

Physical Validations:
Objectives

Answer 2

Who?
-Vendors that you need to spend time on.
-Your high risk vendors
-It takes time, yours and the vendors so make sure you’re spending resources correctly.

How?
-Virtual vis on sight.
Virtual with a collab tool

What?
-What are you going to be asking?
-What’s your scope?
-Does the vendor have their own data center or using a CSP like google, google cloud, AWS?

Where?
-Where are you going to be?
-Company headquarters?
-Manufacturing site?
-Data center?
Data center is often separate from the headquarters

Question 3

Physical Validation Risk-Based Approach

Answer 3

-Amount of Effort
-Criteria
-Cadence and Repeats

Question 4

Physical Validation Risk-Based Approach:
Amount of Effort

Answer 4

-Some organizations are extensive in their research
- Typically for Greg, he does 2 days and 1-2 people

Question 5

Physical Validation Risk-Based Approach:
Criteria

Answer 5

-When does a vendor require physical validation.
Systemically critical vendors on entry
Because of the value of physical validation, might be beneficial to do a physical validation rather than virtual questionnaire.

Question 6

Physical Validation Risk-Based Approach:
Cadence

Answer 6

-How often are you going back to reevaluate?
Should be clearly defined
Risk based
Vendors that have been breached
High risk vendors with high significant findings annual or every other year

Question 7

Physical Validations:
Objectives:

Answer 7

Who?
How?
What?
Where?

Question 8

Physical Validations:
Objectives:
Who?

Answer 8

Who
-Vendors that you need to spend time on.
-Your high risk vendors
-It takes time, yours and the vendors so make sure you’re spending resources correctly

Question 9

Physical Validations:
Objectives:
How?

Answer 9

How
-Virtual vs on sight.
-Virtual with a collab tool

Question 10

Physical Validations:
Objectives:
What?

Answer 10

What
-What are you going to be asking?
-What’s your scope?
-Does the vendor have their own data center or using a CSP like google, google cloud, AWS?

Question 11

Physical Validations:
Objectives:
Where?

Answer 11

Where
-Where are you going to be going?
-Company headquarters? Manufacturing site? Data center?
Data center is often separate from the headquarters