Managing Vendor Risk and Third-Party Access at Your Agency

Your agency depends on a long list of outside vendors. Each one that stores client data or connects to your systems adds vendor risk. This guide shows how to find those vendors, rank them, and keep them accountable without building a huge compliance program.

Why vendor risk matters for agencies

Attackers often go after the weakest link. For a small agency, that link may be a marketing tool, a rater, or a remote support account nobody remembers. When a vendor suffers a breach, your clients’ data can leak even if your own systems are fine.

Regulators also expect oversight. State insurance data security laws based on the NAIC model generally require licensees to exercise due diligence over third-party service providers. Carriers ask about it on questionnaires, too.

Build a complete vendor inventory

You cannot manage vendors you do not know about. So start with a list, then add to it as you find more. Check your accounting records and credit card statements, because they reveal subscriptions that IT never approved.

Typical agency vendors include:

• Agency management system and document storage providers.
• Comparative raters, quoting tools, and carrier download services.
• CRM, marketing automation, and email newsletter platforms.
• E-signature, payment processing, and premium finance services.
• Phone system, texting, and call recording providers.
• IT support, copier leasing, and document shredding companies.

Ask each department for its own list as well. Producers, marketing staff, and accounting often sign up for tools on their own, and those tools rarely reach IT.

For each vendor, note what data it holds, who at the agency owns the relationship, and how it connects to your systems.

Rank vendors by risk

Not every vendor deserves the same scrutiny. Instead, sort them into simple tiers based on data and access.

High risk vendors store nonpublic personal information or have admin access to your network. Your AMS and IT provider belong here. Medium risk vendors hold limited client data, such as contact details.

Low risk vendors touch no client data at all. Spend most of your effort on the high tier. As a result, a small team can run the program in a few hours each quarter.

Record the tier next to each vendor in your inventory. That way, anyone who reviews the list can see where to focus first.

Ask the right questions before you sign

Due diligence does not need a hundred-page questionnaire. For high-risk vendors, focus on a short set of questions that reveal how seriously they treat security.

1. Can you share a recent SOC 2 Type II report or similar independent assessment?
2. Do you encrypt our data in transit and at rest?
3. Which MFA and single sign-on options do you support for our users?
4. How quickly will you notify us of a breach that affects our data?
5. Which subcontractors can access our data?
6. How do we export our data, and how do you delete it when we leave?

Then put the important answers into the contract. Breach notice timing, data ownership, and deletion terms matter most when a relationship ends badly.

Control how vendors access your systems

Many incidents start with a vendor’s remote access tool. For example, a software vendor may leave a support agent running on your server for years. Anyone who steals that vendor’s credentials can then reach your network.

Therefore, give vendors the least access they need, and only when they need it. Require individual accounts with MFA, and avoid shared logins. Also, review vendor accounts quarterly and remove any that sit unused.

Watch for integrations, too. Many cloud tools connect to Microsoft 365 or your AMS through app permissions. Review those connections, and remove any that no one still uses.

Monitor and offboard vendors

Vendor risk changes over time. A vendor may merge with another company, switch hosting providers, or suffer a breach. So review high-risk vendors at least once a year, and request updated security reports.

When you end a relationship, offboard the vendor on purpose. Export your data, disable integrations, revoke API keys, and ask for written confirmation of deletion. Finally, update your inventory, so the list stays accurate.

How WEBIT helps

WEBIT helps agencies build a vendor inventory, tier vendors, and review security reports from key providers. Through our vCIO and vCISO advisory services, we also help you decide which tools to keep, consolidate, or replace. Learn more about our strategic IT services.

On the technical side, application allowlisting on every managed device stops unapproved remote access tools from running. We also offer Privileged Access Management as an add-on to control vendor sessions. See more on our insurance industry page.

Key takeaways

• Every vendor that stores client data or connects to your systems adds vendor risk.
• Build an inventory, then tier vendors by the data and access they have.
• Ask focused security questions and write key answers into contracts.
• Limit vendor access, review it quarterly, and offboard vendors on purpose.