The Milliman Security Management System for Vendor Management (MS2:VM) assures that your vendors and other outsourced service providers have effective security controls. MS2:VM provides an easy-to-use solution for improving controls on vendor security that can save hundreds of thousands of dollars while reducing potential exposures from vendor security breeches.

MS2:VM helps large organizations assure that service vendors maintain the same standards expected of the organization itself. It is an all-in-one solution to audit vendor controls that addresses SOX, GLBA, HIPAA, and other IT and security requirements.

MS2:VM is best suited for organizations that need to:

• Evaluate the security safeguards of new or existing vendors
• Determine if a new vendor maintains necessary safeguards
• Assess and monitor vendor compliance to generally accepted security practices
• Benchmark vendor security practices with other vendors
• Audit vendor security compliance
• Identify high risk vendors and/or vendor security practices
• Hold vendors accountable to their security control representations

Product Features

MS2:VM provides compliance assessment features that track vendor risk and remediation commitments. The system is web-based for easy deployment and scalability. Non-programmers can also customize MS2:VM to meet the needs of specific vendor relationships.

This solution:

• Tracks and reports vendor relationships at any organization level including subsidiaries, business units, logical business units, and project-based vendor assessment
• Automates control assessments with easy-to-use questionnaires that the vendor can complete at a secure on-line website
• Performs complex security risk assessments seamlessly
• Automatically provides a security safeguard gap assessment
• Categorizes gaps for assessment and remediation purposes
• Performs technical and non-technical security assessments based on generally accepted industry security practices (e.g. BITS, NIST ISO, ISSA, etc.)
• Documents control validations and tests performed by your organization or the vendor and provides rating controls to qualitatively assess the validation process
• Produces a robust set of compliance reports
• Security Policies & Procedures
• Risk Assessment Results by location, area, threat and vulnerability
• Security safeguards mapped to generally accepted standards and practices (NIST, ISO 17799) standards and frameworks
• Provides benchmark reports
• Tracks vendor remediation commitments
• Includes Help Desk Support