Cybersecurity Risk Rating Tool

Clemson University is seeking a Cybersecurity Risk Rating Tool to automate the collection and analysis of externally available third-party risk data. The tool should enable evaluation of prospective vendors, monitoring of existing third-party partners, monitoring of fourth-party vendors, and prioritizing risk remediation efforts. The university requires a comprehensive solution that includes data output for subscribers, data gathering and accuracy, third-party collaboration and outputs, reporting and analytics, and customer enhancement requests. The solution must comply with all applicable laws and regulations, including FERPA, Clery Act, ADA 508, COPPA, and HIPAA. Some key features and requirements include: • Risk-prioritized findings that quantify the severity of each security issue and the asset value • Categorization of assets and vendors by department/point of contact • Creation of action plans based on risk priority • Interactive knowledge base with straightforward explanations and recommended actions • Corroborating evidence to support conclusions • Methods for building company profiles and security assessments • Measurement criteria, including the number of individual criteria and the percent of criteria that are measures of threat intelligence • Frequency of vendor profile refreshes and the ability to quickly profile new vendors • Security findings and criteria obtained from third-party sources • False positive rate and procedures for ensuring accurate results • Confirmed data error correction procedures • Sharing of findings with third parties and any associated fees or limitations • Storage of evidence artifacts • Executive-level reporting and comparable baselines for applicable industries • Supporting evidence availability via download and API service • Ad-hoc search capabilities across the portfolio • Customer feedback incorporation into the product roadmap