Procurement

Organizations in every almost every industry are utilizing more third-party, non-employees such as contractors, vendors, partners, supply chains, and non-humans like bots and service accounts to cost-effectively meet competitive pressures.  While the business benefits are clear, the hidden costs and increased exposure to risk are often not.

One SecZetta client recently compared the effort to onboard third-party users using pre-existing tools and processes and found it invested an up to 40 staff hours between the line of business and an HR resource per third-party identity, applying a simple red light/green light (on/off) strategy vs. a matter of hours with SecZetta. While this estimate includes the steps for authorizing physical and logical access, it didn’t include the staff time needed to manage the lifecycle of the users (review and verify access, manage access changes, audit for compliance needs, and terminate access). 

Another item often contributing to hidden costs is the use of HRIS systems to manage non-employee data.  In addition to averaging between $150-$200 per identity, managing non-employee data in HRIS solutions exposes the organization to employment misclassification liabilities.   

Unfortunately, most organizations, even large global enterprises, do not have sufficient resources and systems in-place to enforce business policies for the timely and effective collection, processing, and operationalization of third-party, non-employee information.