Organisations depend on vendors, suppliers, contractors, subcontractors and partners to run and manage businesses. Cyber risks arising from conducting business and interacting with these third parties are a common cause of data breaches and cyberattacks, often leading to financial, reputational, strategic, and operational damage. Assessing and managing the cyber risk posed by third parties to enterprises is called Third-Party Cyber Risk Management (TPRM).
Third-Party Cyber Risk Management Framework
There are many frameworks to address TPRM, but most frameworks can be understood or adapted in the following steps:
Pre-contract
- Evaluating the company’s strategic direction, operational requirements, and any existing security risks, especially in the business areas in contact with third parties.
- Categorising risk based on severity and applying mitigation controls.
- Identifying suitable third party, setting up TPRM processes, conducting due diligence at compliance and operational levels, negotiating, and onboarding the chosen third party.
Post-contract
- Setting up inventory controls, updating policy and procedures, and providing training to personnel in the enterprise and third party.
- Implementing monitoring controls, such as emerging security risks, metrics, performance data, change management, and conflict resolution.
- Addressing existing or residual risk from the third party after onboarding, supplemented by monitoring data and insights.
It is essential to think of TPRM as not merely a technical exercise but a holistic lifecycle that starts when the supplier is considered initially, including the management of the relationship and its eventual termination. Every new entrant into an organisation’s ecosystem introduces its own risks and vulnerabilities – at any point in the lifecycle.
A sound TPRM framework must account for procedural and operational requirements and must address reputational and compliance risks, as well as formulate a disaster recovery plan for each type of risk. Businesses find that seeking TPRM-related guidance and advice from experts such as BlueVoyant may help them mitigate unwanted cyber risk from third parties on an ongoing basis. BlueVoyant’s cyber risk management services give organisations a clear oversight of the cyber risks threatening their business by proactively identifying, prioritising and remediating them across their ecosystem.