Vendor management offices (VMOs) play a critical role in ensuring the security of an organization's information technology systems. One of the key responsibilities of a VMO is to perform due diligence on third-party vendors to ensure they meet the organization's security standards. In this article, we will discuss what an information technology (IT) team should look for regarding cyber security when performing due diligence on a third-party vendor.

1. Security certifications and compliance: The vendor should have current certifications, such as SOC 2, PCI-DSS, and ISO 27001, as well as compliance with relevant regulations, such as HIPAA and GDPR. These certifications and compliance demonstrate that the vendor has been independently audited and found to meet a certain level of security.
2. Security policies and procedures: The vendor should have documented security policies and procedures that outline how they protect customer data and their own systems. These policies and procedures should be regularly reviewed and updated to ensure that they are in line with industry best practices.
3. Incident response plan: The vendor should have a documented incident response plan that outlines how they will handle a security incident. This should include steps for identifying, containing, and mitigating an incident, as well as procedures for reporting it to the appropriate parties.
4. Security testing: The vendor should regularly perform security testing, such as vulnerability assessments and penetration testing, to identify and address potential vulnerabilities in their systems.
5. Employee security training: The vendor should have a program in place to train employees on security best practices, including the handling of sensitive data and identification of potential security threats.
6. Background checks: The vendor should conduct background checks on all employees who have access to sensitive data.
7. Insurance: The vendor should have cyber security insurance to protect them and their clients in case of a data breach.

Performing due diligence on a third-party vendor is an essential step in ensuring the security of an organization's IT systems. By considering the above factors, an IT team can better evaluate the security of a vendor and make informed decisions about whether to work with them.

In conclusion, IT teams should consider security certifications and compliance, security policies and procedures, incident response plan, security testing, employee security training, background checks, and insurance to ensure they provide the necessary level of security for the organization.