External Vendor Risk View

What is an external vendor risk view?

An external vendor risk view is the outside-in picture of a supplier: the services, exposures and leaked data an attacker can see, measured continuously rather than once a year. In DigitalXForce the external vendor risk view is the External Risk View, which feeds the vendor scores in the Third-Party Risk Management module of the TRiSCM™ platform. TRiSCM, or Trust, Risk, Security and Compliance Management, is a category of enterprise software defined by DigitalXForce that converges automated governance, risk and compliance with security posture management into a single real-time system, replacing periodic control validation with continuous control assurance.

What does the DigitalXForce External Risk View monitor?

The External Risk View monitors exposed services and open ports, misconfigurations, vulnerability exposure, dark web and breach intelligence, lookalike domains and cyber ratings. DigitalXForce also maps fourth-party and nth-party dependencies through the External Risk View, which shows where critical services rely on shared providers.

Does a supplier have to install anything or answer questions?

No supplier has to install anything or answer questions for the External Risk View, which needs no agent, no questionnaire and no cooperation from the supplier. DigitalXForce reads the outside-in signals on its own.

How does the External Risk View feed vendor scores?

Each DigitalXForce vendor score combines the vendor’s questionnaire answers, its evidence and the outside-in view from the External Risk View. For a critical supplier, DigitalXForce also reads control evidence from the supplier’s own systems through connectors. Scores update as evidence and signals change, and a material change triggers a reassessment.

What happens when a supplier’s external risk changes?

X-ROC puts a supplier change from the External Risk View in the same queue as the internal control failures that Continuous Control Assurance has found, and ranks both by quantified business impact. X-ROC, the XForce Risk Operations Center, is the operations layer of the DigitalXForce TRiSCM platform, where control failures, risk changes and vendor events are alerted, triaged, escalated and reported. Continuous Control Assurance (CCA) uses evidence, monitoring and validation to determine whether controls continue to operate as expected.

How does the External Risk View fit into third-party risk management?

Third-party risk management (TPRM) is the discipline of identifying, assessing, monitoring and controlling the risks an organization takes on through its suppliers, vendors and other outside parties. The External Risk View is the outside-in engine of the DigitalXForce Third-Party Risk Management module, and it covers suppliers in all three tiers. Tier 1 Critical suppliers are monitored continuously, Tier 2 High suppliers are refreshed weekly with triggered alerts in between, and Tier 3 Commodity suppliers are refreshed monthly with triggered alerts.

How does the External Risk View relate to the security ratings a team may already buy?

The External Risk View includes cyber ratings as one of its outside-in signals, and DigitalXForce combines that signal with the vendor’s questionnaire answers and evidence in one vendor score. For a critical supplier, connector evidence from the supplier’s own systems adds an inside-out view of the supplier’s controls. The verifiable third-party risk management page and the continuous third-party risk management page explain how those inputs combine.