{"id":9186,"date":"2022-12-08T14:06:36","date_gmt":"2022-12-08T22:06:36","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=9186"},"modified":"2023-06-26T17:11:17","modified_gmt":"2023-06-27T00:11:17","slug":"streamlining-vendor-assessment-with-servicenow-vrm-at-microsoft","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/streamlining-vendor-assessment-with-servicenow-vrm-at-microsoft\/","title":{"rendered":"Streamlining vendor assessment with ServiceNow VRM at Microsoft"},"content":{"rendered":"
\n
\n
<\/div>\n

This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n

\"MicrosoftWe\u2019ve adopted ServiceNow Vendor Risk Management (VRM) to manage our risk assessment during the procurement process for Internet of Things (IoT) devices across Microsoft.<\/p>\n

ServiceNow VRM provides a centralized, managed solution for assessing security risks for IoT devices and the vendors that supply them for us. With this solution, our vendor risk management processes at Microsoft are more automated and efficient, better monitored, and easier for our employees and vendors to use.<\/p>\n

Introduction<\/h2>\n

At Microsoft, our business necessitates an extensive supply chain that depends on trusted non-Microsoft vendors. These vendors provide much of the hardware and software upon which we run our business. Our Microsoft security team ensures that our vendors and the hardware and software they provide adhere to our compliance and security requirements.<\/p>\n

As part of our broader governance, risk, and compliance processes, the vendors and partners that supply these products and services must undergo an assessment of their operations and the products or services they supply. The security team provides technical expertise to confirm that software and hardware adhere to modern security practices. We have multiple business groups that work with the security team to assess vendors. Each business group has nuances that affect the way the security team creates and processes vendor assessments.<\/p>\n

One such example is the IoT Security Assessment program. This program focuses on IoT devices procured and deployed throughout Microsoft. Each vendor and the product they supply must be vetted to maintain our security standards.<\/p>\n

Improving the vendor assessment process<\/h2>\n

Globally, we at Microsoft manage thousands of IoT devices supplied by many different vendors. These devices include card readers, cameras, kiosks, and HVAC systems equipment. Each of these devices and the software that supports them must undergo the security assessment processes established by our security team. The basic assessment process includes the following three high-level steps:<\/p>\n