Girish Redekar

The main purpose of periodic audits is not to check-a-box but to create feedback. Audits not only help understand if the vendor's posture has changed, but very often, it also uncovers cases where your own exposure to the vendor has changed, and consequently needs recalibration of the requirements from the vendor. A constructive feedback loop from these audits helps improve both your and your vendor's security posture.

It's important to treat the vendor assessment as a two-way-conversation instead of an examination. By fostering an open conversation, you get to truly understand your vendor's security posture in their own context, and consequently determine what risks it poses to you. This also means that vendors are now more likely to improve their posture to meet your requirements.

Improving your security posture without a risk assessment is like going blindfolded into the woods - you won't get far. A risk assessment gives you the tools to determine what exactly you're protecting, and a way to prioritize the efforts. Remember that improving your posture isn't an on/off switch and a RA helps you get most bang for your efforts and money.

One of the most common fears or barriers to adopting new technology is simply the lack of familiarity. The fear of unknown can be large. Training brings familiarity, which brings comfort, and dissolves any resistance to change. Training can also help show better ways of doing something. Training can be in various forms - pick the right channel depending on context. Videos, workshops, guides, AMAs, etc are all great options to pick from

It's important to understand the context of your audience: their role, their work, their goals, their challenges. This gives you levers to get your message across. Specifically ... - Give relatable examples that make sense in their work - Build understandable analogies from commonplace or their context-specific environment - talk about how specifically affects their work

I’d recommend a risk based approach to assess the impact of emerging technologies. Some specific actionable steps:
 1. Model your risk using some risk quantification framework. There are a few out there (FAIR, NIST RMF, etc). Pick the one that suits your purpose
 2. The models are only as good as their inputs. Engage with relevant stakeholders and assess the inputs to ensure they’re closer to reality 
 3. Use the risk model to identify the risks to prioritize. This will help “sell” your strategy to the top management, and win budget for mitigation