If you operate as a B2B organization (business to business), you are either part of the supply chain, manage a supply chain, or you fit into both categories - the latter being the most prevalent. Tools like BitSight provide insights and actionable data to make informed decisions on risks, regardless of where your business sits in the supply chain.

A BitSight rating may not be familiar to everyone, but when it comes to choosing what businesses to partner with as a vendor or third-party provider, this score can be insightful and educational. BitSight is a company that calculates security ratings to shed light on an organization's security performance and measures cyber risk. Think of it as a cyber security credit score that you can evaluate before doing business with an organization, much like lenders use FICO credit scores to review potential applicants. With the overwhelming number of vulnerabilities and threats, motivated attackers, and increased attention to global privacy concerns, having access to a score like this can provide valuable context when evaluating the risk of doing business with current and prospective partners. Who wouldn’t want to this in their repertoire?

How is the BitSight Rating calculated?

BitSight rating calculations are a combination of data sets gathered through their proprietary automated service that analyzes massive amounts of data. The process entails detailed methodologies which relies on a combination of human and machine intelligence to ensure the validity of the collected data. BitSight ratings leverage objective data and do not penetrate an organization’s internal systems. The first step in the process is network mapping, which relies on public data and patented methods to locate an organization’s assets. Next, they look at risk vectors, falling into the categories such as compromised systems, user behavior, and diligence. Some examples of things that can affect BitSight ratings are malware, unsecure file sharing, vulnerabilities, and lack of controls against email phishing attacks. Predictably, riskier elements will carry greater weight and more heavily affect the grading process. To ensure ratings are based on the best data and methods, BitSight updates their ratings algorithms periodically.

An organization can check their rating on the BitSight website for free but will pay fees for more detailed insights and services.

Using BitSight to Monitor Your Supply Chain

Why should legal departments and law firms care about these ratings? After understanding what the rating systems explains about an organization’s security position, it is prudent to monitor current and potential supplier or partner BitSight ratings. These ratings increase visibility into an organization’s risk posture and promote informed interactions between global market participants which can provide a greater sense of trust by knowing that a particular supplier is secure. Additionally, these ratings will alert organizations when a supplier is not maintaining proper security, which will highlight potential security risks. Having this knowledge enables organizations to determine which suppliers to keep using, when to have a discussion with a supplier about security gaps, and when to make the decision not to use a particular supplier. Continuing to monitor an organization’s BitSight rating after a security breach or major organizational change will also highlight progress and improvement.

BitSight ratings provides a comparison of an organization’s security to relative industry benchmarks. This is not limited by industry or size. Again, this results in the ability to make informed decisions about which vendors to partner with and how to approach conversations about cyber security. Corporate data often contains very sensitive and personal information, so protecting it needs to remain a top priority.

Using BitSight to Monitor your Attack Surface

As a part of the supply chain, it is important that you do your part to protect your organization and in turn, limit the cyber risk exposure to your customers and partners. Solutions like BitSight can give an outside in view of your organization to identify any deltas from your own internal monitoring tools. The macro view is helpful in providing actionable insights for your IT and security operations teams to address unknown risks. Identifying and keeping up with the attack surface is one of many challenges security teams face and BitSight provides an amalgamated view with a simple to understand dashboard of prioritized security gaps.

“As CISO of Epiq, I not only monitor our BitSight rating to ensure we are providing our clients with the highest level of security, but as part of the supply chain, I also monitor our suppliers rating to make sure Epiq data is safeguarded.” Jerich Beason, CISO

What’s Next

With this overview of what a BitSight rating is and what benefits it can bring, no matter where you sit in the supply chain, it is worth looking into the value of monitoring these ratings for both your suppliers and your own internal security programs. However, remember the limitations of the rating and factor this into any operational decisions.  For example, a BitSight rating does not address policies and process maturity. The ratings you access will be provide benchmarks and transparency into the scoring methods as well as how each organization stacks up against its peers. All this makes having these ratings valuable and will allow legal organizations to make better cyber risk informed business decisions about how they invest and choose vendors. We are moving into an era where mutual accountability is a must to not just secure your organization and supply chain but the digital landscape as whole.