Today on our Tech for Business podcast, we're
joined by Kyle, our president and CEO, and Todd,
our COO and CISO to talk about the importance
of vetting your vendors. So obviously we're going
to start with the why. Why is this important?
I think it highlights a lot of the lens that
we select, who we bring to solutions to our customers
as we look at. different solutions that are out
there, because there's a number of them. We have
to go through the process of understanding and
say, is there value here for our customers? And
can we leverage aggregation of CIT's customer
base as far as the number of customers, our expertise
that we can invest into training and fractalization
of the services to those customers to help them
deploy it? is that overall value there that actually
solves true business needs for our customer sides
is really quite simply where we look at is we
look for the use case. And it's important, I
think, to look at most of our customers fall
into the small to mid space with it. And a lot
of the solutions that we bring to the table are
around the area where it doesn't make sense for
them to hire a full -time employee, but they
definitely have a need for for the solution and
they need to have those like the enterprises
do, but they're not going to have the staff of
an enterprise. So we look to fill that gap, both
from integration and support and service. So,
Todd, can you go into a little bit more detail
about maybe the risks of not just us, but businesses
not doing their research or doing their due diligence
when choosing a vendor to work with? Yeah, I
sure can. I'm just sorry. The reason why I kind
of paused is because I was thinking about it
and says, do I do I start with the typical I'm
going to scare you kind of concept, which is
not my intent. I don't want to get into the fear
and certainty and doubt. But but just kind of
think about this for a second. I can I can share
a link that's got a bunch of statistics on it.
But I think the stat I saw the other day was
98 percent of companies. work with somebody that's
had some sort of security event. And so just
think about that. I mean, you're almost certainly
working with a vendor who has had a security
event at one point or another. It's kind of interesting
from our perspective, as I want to say it was
three, four years ago, where we're going, okay,
well, we think this wave is coming at us where
the threat and the risks have extended beyond
our walls, and it's come from the partners that
we're working with. And not only did that wave
come, it came crashing over the flood barrier,
if you will. And so, you know, just kind of thinking
about what's introduced is if you don't have
a formal way of evaluating your vendors that
you're working with, your partners, et cetera,
you're essentially, for all intents and purposes,
you're just automatically inheriting any risk
that they may present to your organization. That
could be financial, it could be reputational,
et cetera. And so just kind of thinking about
that as why it's important is if you haven't
paid attention, you're potentially in for a world
of hurt. Now, when it comes to regulatory industries,
so your banking, your finance, those types of
things, their policies are all written and required
that your security program needs to be as good,
I'm sorry, your partner's security policies need
to be at least as secure as your own. So again,
kind of going down that path, you expand on the
risks that are associated with businesses. And
so that's just one of the key areas that I would
at least start the conversation with. Well, so
I know we don't want to scare people. So maybe
let's talk a little bit about the positives of
the benefits of doing your due diligence. I know
we had a different podcast where we talked about
building those partnerships. So how does going
through this process set you up for a better
partnership later? Yeah, I mean one of the things
that we do at CIT and this would be just to me
and be part of your vendor management, but as
you're going through the onboarding process,
you should be kind of looking for things that
would stand out to you. Is this a good organization
we want to work with? To me, I'm going to have
a little bit of a security slant on this. So
I'm going to naturally gravitate to, let's look
through your security controls. Are they what
I would expect there to be? So if they are, you
automatically start getting a good warm fuzzy,
if you will. It could be anything like, for example,
I tend to like working with organizations that
have put the time and energy into becoming compliant
with GDPR or some of the more maybe progressive
ones like the Californias. requirements and whatnot
because it means that they've taken the time
to make sure they're doing the blocking and tackling
of cybersecurity. And so it makes me think they
care enough to make sure that everything's shorn
up. Now granted the vast majority of the reasons
why they do that is financially driven, right?
They want to make money in order to do business
with certain organizations they need to do this.
The other thing that we do a lot of is we like
looking for references as we're working with
partners. So if there's a great big critical
vendor, if you will, we will go through the vetting
process and it's great to hear probably a little
tip on how people do this, but it's great to
hear when you talk to other C level organizations
that this company did not put me at risk or this
company allowed me to solve XYZ problem. Yeah,
Kyle, maybe you can give us continuing with the
benefits. When you are looking at your own company
and planning 10 years out that strategic planning,
you know, how do you choose a vendor that's going
to grow with you? What are those questions that
you're asking to make sure they're on the same
track as you? Does that make sense? Yeah, it
does. I mean, a lot of it is just, again, falls
back to the kind of the supply and demand. Part
of it is, are they solving evolving needs that
are starting to show up in our customer side?
So when you meet with the customers, you hear
their their concerns, you hear their pain points
or their wants and objectives of what they're
trying to accomplish for, which then puts us
in a similar track where we're looking to how
are we going to solve those challenges. Quite
often than not, we're already experiencing ourselves.
We're in the same position as our customers.
In many cases, it works out. So as we look to
solve CITs, areas where for our SOC 2 or our
compliance, or as we're changing these things,
we look for solutions that not only benefit and
solve our sides, but something we can use to
solve for our customers. So we're a customer
and a partner of those of those vendors, which
kind of allows us to also put our, our, our money
where our mouth is and say, we trusted ourselves,
you know, we, it's not that we vended it for
ourselves, we trusted for ourselves, we feel
much better, we experienced being a customer
first, or our customers had to experience inside
of it. And if, if it didn't go up for us, then
we're not going to be probably real excited about
extending that side. But if the supply is there
in those things, the way technology works, it
tends to have a long run rate side. But we want
to look at their whole solution portfolio, how
their position does it, does it, is it, is it
easy to support? Do they have good support? You
know, we want to know that If ourselves or our
customers are having an issue side, how good
or responsive are they? Are they something that
we feel that we can work with them to get resolved?
Those are all key things. We don't think of those
checkboxes and it's a little bit of like Todd's
lens on the security side to know that. They
obviously have an understanding of the importance.
If you feel those key areas size that they have
good support, they're responsive, their solutions
are evolving in those things that they have a
culture that is aligned right for growth and
alignment for us to grow together with. Yeah.
So when businesses are going through this process,
they probably have a checklist. What are common
that are missed on that checklist. You know,
I think security is a big one. They know to ask
about data, privacy is probably one that's on
the list. What's not on that list? Yeah, I'm
struggling with it because the reason being is
we've gone through this for years and vendor
management doesn't work through me, but our processes
has been very... evolutionary so as things change
and we find oh that was a problem we just add
it and we've been doing that for so many years
I don't even look at it any longer going you
know what the big aha is I would say to me at
this point one of the larger things that that
I find is problematic for us is when we're doing
the process the what are we doing why are we
bringing this tool on and what why is it what
is it doing for the organization that does not
always move all the way through the organization
so I'll just say myself as an individual is bringing
on a tool I find that's got to fit. I communicate
with our management team. And then sometimes
that's the extent of how it works its way through
the organization where it should get down to
the next layer and the next layer below that.
I would say that is by far one of the larger
ones. But generally speaking, I'm going with
making sure that when you go through this process,
you kind of, in my opinion, you should have a
team that works through it. So we have built
the checklist for our And things that you should
just naturally have in that process is what does
procurement look like? Obviously, you should
have legal and compliance included. Both of those
report to me. So again, they seem pretty obvious
to me. And sort of security. Finance is another
one that should be in there. And I don't know
how frequently organizations ensure that there
is a... a strong financial backing of the partner
you're working with. And again, this may depend
on how critical that tool or that partner is
going to be. If it's going to be your main accounting
system, you're going to want to make sure that
they're in it for the long haul and not going
to disappear next week. Those would probably
be a little more obvious, but that's where my
brain goes with the start. Yeah, I would only
add to that. I mean, I think on the financial
side is not only that, are they going to be acquired?
Because that changes the culture more often than
not. And that's usually where we've seen existing
partners change is with the change in the owner.
If it goes from a founder level visionary to
a private equity owned side of it, it can shift
the quality and the future of the products. So
you need to kind of gauge that. Sometimes you
still go into it just knowing that that's the
case. It depends how early you're on with that
particular product, too. You know, a bit earlier
in the side, you're going to ride a wave of growth
that's probably got a lot of demand. At some
point, they're going to be going to sell, but
you have to probably know what's coming, you
know, and then you just stay connected to those
things. And it's not always bad, but it's just
something that it's a potential risk to the long
term when you use your tenure. yardstick, you
know, it may impact that. The other side is how
they handle account management. Are we going
to get a named account or have somebody to manage
it? Especially on a key vendor side, I mean,
it can make a big difference. You know, like
when we talked with Mike Eternal at the podcast
and brought him on side of it, again, he's a
good example of having a good representative
from those vendors that engages in our vendor
management group and engages into our sales team.
even into our leadership side of that and making
us aware of changes and what's coming on their
side of it makes a big difference. You know,
it's the same way we handle with our customer
sides. It's tough to be trying to read and have
to search it out on your own. It's good to have
a relationship. Somebody starts to understand,
hey, this is, CIT is really good at this. I think
we can refer sides of it. We know what their
capabilities are. It's mutually good. understanding
their approach to that can really make a big
difference of how much that that vendor partnership
between us and that vendor really flourishes.
Yeah, you mentioned culture, which I think is
an interesting thing to dig into because that
again, when we're talking about this checklist,
that's maybe not always on the checklist is what
is the culture of the company I'm going to be
working with. So how do you get a sense of what
their company culture is and how it's going to
work with. Or is that a checklist question? Probably
is. But I mean, I think it's it's I don't know
if organic is the right way to do it. I mean,
I think it really comes from the conversations
and in your discovery process going through.
You get a feel for it, just like you do on most
sides of it. And sometimes you ask a little probing
questions and understand, you know, what what
they do for company, you know, outings, what
Where do they work at? Are they fully remote?
Or do they have a Google -less, open environment?
You get different responses to those sides. Where
are you located at? We have vendors that are
located all over the world at this point that
come into play. So you get different sides of
that. So you can build a pretty good picture
of what it looks like. And in some cases, we...
As it grows more, we can get on certain advisory
committees or other sides of those sites where
we're even closer. We actually visit and other
ones you have conferences. You start to learn.
It's more of just some through the discovery
side of it. And you can do some social media
review and stuff and get an idea of that to get
a little better read on it too. But it's usually
just of interactions. At least it is for me.
Yeah, and I wouldn't say it's necessarily a critical
thing for every scenario. Say, for example, if
you get into a vendor that's very commoditized,
or you're getting into a price competition, and
that's one of the large pieces, it's probably
not nearly as critical because those ones you
can relatively easily switch if you need to.
But when they are critical ones, where I would
go with it again, as I mentioned it a little
bit further, a little bit ago was... Going back
to referrals, if you can get referrals and start
to have those deeper conversations, you get a
really quick sense of what those companies are
to work with. You don't usually get raving fans
from ones that have poorer cultures. That's fair.
Yeah. Referral is a great way to go. We kind
of went on a journey with this conversation,
but I do like to give some practical advice on
these podcasts. So Todd, you did mention... There
are two different groups of businesses, there's
more than that, but we're gonna break them down
into two different. You've got ones who have
compliance and ones who don't. So when you're
doing that vendor due diligence, do you think
it's easier to come from a place that has compliance
requirements, or does that make it more difficult
to do this process? Both. The reason why I'll
say both is I think the structure of coming from
compliance makes the process defined, and because
it's defined, you practice it, and the more you
practice it, the better you get at it, the easier
it gets, and so forth. The downside is you actually
have to do the work, right? So for example, if
you're talking to a vendor and you come back
and say, I want to see your SOC 2 Type 2 report,
you'll get it. And just getting it is not what
you're typically doing when you're going through
the vendor due diligence. The due diligence part
is actually exactly that, right? And that means
I have to read the document and say, is this
what I expected? Does the disaster recovery plan
match my expectations? So that part of it is
a lot more work, because if you... you're not
formal, you may go, yep, I got the checklist.
The fact that they have a SOC 2 audit is probably
sufficient. Put it in the folder, move on. That
part would be really, really easy. But you're
doing it the right way, if you will. And sorry,
I come from a compliance industry. So I think
it is important to do it the proper way and check
the boxes and make sure that you actually did
the due diligence of the whole process and making
sure that you're reading the documentation. So
for those... Not in a compliance and kind of
don't know what to ask What is some advice you
would give them about you need? These are my
top three things you should be asking for at
that table Yeah, so that we kind of covered a
few of those already I mean if you are not in
a compliance industry the first place I would
start is is the fiscal aspect right making sure
that it's a It's a solvent company. It's gonna
be around for the long haul those kinds of things
is where I would start Again being a security
guy that I am. I will want to know what those
safeguards are What are the controls that are
in place? And so then the things I'm going to
start to ask for are Hopefully most organizations
have a little bit But as I kind of started out
this and I didn't want to scare anybody if if
you know that most Vendors have had some sort
of security event. You probably want to know
how did that happen? What did you do about it?
How has it gotten better? We like to use a vendor
of ours that we work with For Kata, if it matters.
And they had gotten significantly better after
their security event and they documented it.
We did X, Y, and Z, and here's how we're going
to keep this from happening in the future. Getting
that type of information is incredibly critical.
Now, I wouldn't go into the due diligence process
saying, did you ever have an event and what did
you do about it? I probably wouldn't start there.
But if you can get some of those additional documentation,
whether it's ISO, SOC 2, et cetera, if you can
get that and you start requesting that information,
it will be very well. outlined and they'll start
to tell you what they're doing to make sure that
they're secure. Yeah, I think, I think it's,
it's, it's good rationale to recognize that if
a lot of the other check boxes are done, like
Todd's point, most of those, and especially if
they showed professionalisms and due diligence
on how they're accurate, they're, they're probably
a far better secured company at this point than,
than they would ever be because it's kind of
heightened attention versus a company who has
not ever experienced. So you do have to kind
of weigh that into some of your conclusions that
it wouldn't necessarily past problem doesn't
necessarily rule them out, you know, that that
can make them more attractive in some regards.
So you do have to take that in consideration,
I think. I think if there was one question I
was going to ask, it would say it would be. Can
you send me your due diligence package? And that
can be fairly broad, because they will give you
exactly what their standard package is, and you
don't have to be very mature or formal in it.
They will send you what they have. Now, if you
feel like there's things missing, you can certainly
go back and ask for more. But that would be one
simple question that'll get you the majority
of the way of where you're going to go. So Todd
did a great job kind of covering it. Kyle, is
there anything you would add to those must? ask
questions in that vendor due diligence. I mean,
I think we really covered it. I mean, I think,
you know, first and foremost, it's got it's got
to solve the right solutions, got to check the
boxes for the solution that you're solving. I
mean, that's that's obviously step one. They
have a they have a solution to the problem. And
then it's, you know, is it a good company? Is
it a solid company? And does it align and fit
the way that The way we look at it versus standalone
company, we have some other criteria about being
able to support multiple companies within their
platform and be their vendor side of it. So we
have certain other check boxes that we need to
do to make sure that it's conducive for multi
-tenancy and a managed partner management. But,
you know, if you are an MSP, that would be obviously
some of those things. We have other things that
want to tie into our SSO and all the other side
makes our compliance plugins. Those are all benefits.
You know, it doesn't rule. There's put stuff
in the plus columns, you know, on there. But
yeah, I mean, the big the big ones solve the
need. Are they financially viable? Are they secure?
I mean, I think, you know, if you get by those
criteria, then you're then you're nearing down
to the rest of the other things I just talked
about on. things that go on the plus column,
things that go on the negative. So if you're
comparing multiple solutions, you can kind of
weigh it out and figure out which one's the best
route to go. I want to ask about how often do
you re -evaluate a vendor? So you've signed them
on, they're with you. Is this a yearly process?
Is it daily? What does it look like to continue
this process? I was going to go, before we wrap
up. Again, I do think it will depend on how critical
vendor they are for you. So some of them may
be pretty straightforward. What they're providing
is pretty standard and you don't have to worry
about it. But if it's a critical vendor, I would
be doing it at least annually. Ideally, it would
be potentially more frequently. So I'll just
use an accounting package as a one that's pretty
standard and there's probably not a lot of change
year over year. So annually is probably sufficient.
However, there may be other tools that are out
there and whether it's a security tool or a core
business app in the organization, where there
are things that are changing on a fairly regular
basis, whether they're doing acquisitions, they're
adding new features, getting a sense of what
the roadmap looks like and how it's going to
solve business problems may drive or change your
direction where you want to have those conversations
more frequently. So depending on that organization,
maybe quarterly, it may be as often as monthly.
We have patients with some of our vendors every
single month. And I think that they're extremely
well worth our time to do so. But to answer the
question directly, I would say at least annually
for anybody that you consider to be a critical
vendor. Yeah. Yeah. I would, I would. I mean,
you mentioned the comment at daily. I mean, obviously
if there's erosion of problems, it's exonite
those things, but more of the nodded aligns to
our contractual obligation side of those. And
then just, you know, It is a little bit of the
daily interactions of how it's going to kind
of evaluate it, as well as, again, the support
and how well the product's working. You know,
if we're having a lot of support challenges,
other sides on it, we may pivot into another
direction and find an alternative solution. Yeah,
definitely. Anything else that we didn't cover?
I don't want to make too big of a deal out of
it, but you can probably tell where I am coming
from. I do think it's important to do your due
diligence. As I mentioned, if you're not paying
any kind of attention whatsoever, you're just
automatically inheriting all the risks that go
by the fact that you just didn't do anything.
So you got to at least ask the question. So if
you don't have a program, I would recommend getting
at least a little bit of one. And like I said,
you can start real, real small and just do conversations
like Can you send me the due diligence package
for this year? So even if you haven't done it
in previous years, you could start there immediately
and say, again, it's your top two vendors and
say, send me your due diligence package, and
then you can start to sort through it and see
what your legal obligations are. Do you have
contract concerns that are in there? Whatever.
But I would start somewhere if you don't have
one. That's all right. Yeah. Perfect. Nice. It's
like a great place to rack. Thank you Beth for
joining us today. If you enjoyed this topic,
please let us know. Like, subscribe, or reach
out to us at info at cit -net .com or head out
to our website cit -net .com slash podcast. We'll
be back next week with an all new episode.