Third-Party Vendor Risk Assessment: ClientVantage CRM
Overview
A formal vendor risk evaluation, written as a memo to Meridian Wealth Partners’ Investment Committee and Risk Management Group, ahead of renewing the ClientVantage CRM contract. The platform stores ultra-high-net-worth clients’ non-public personal information, account details and KYC/AML documentation.
What I did
- Reviewed the vendor’s control design, its SOC 2 Type II audit report and its questionnaire responses.
- Mapped obligations to the GLBA Safeguards Rule and SEC cybersecurity risk oversight guidance.
- Assigned an overall risk rating and recommended conditions for the renewal negotiation.
The deliverable
