Companies in the finance industry supply chain are not meeting the same security standards that finance organizations hold for their own businesses, meaning third-party vendors are putting financial firms at risk.

Cambridge, Mass.-based BitSight in its a new report, "The Buck Stops Where? Assessing the Cybersecurity Performance of the Finance Supply Chain," found a significant security performance gap existed between finance firms and companies in their supply chain. The mean rating for finance companies was at least 30 points higher than the mean of companies in their supply chain.

While finance organizations tend to have more sophisticated vendor risk management programs, there is a lot of work needed to close the performance gap between their own organizations and their immediate business ecosystem, Stephen Boyer, co-founder and CTO of BitSight, said. "The findings of this report are not only relevant for the finance sector, but for companies across all industries who share data with and rely upon external business services. Organizations should scrutinize the security culture and controls of their third and fourth parties. Ensuring that your vendor's systems are up-to-date and that their employees are not engaging in risky peer-to-peer file sharing is one way to reduce immediate third party cyber risk."