Why does-your-company-need-a-third-party-risk-management-program

Why Does Your Company Need a
Third Party Risk Management Program?
Created & Designed by :
Everyone is familiar with the term
“RISK MANAGEMENT”
Society of Cyber Risk Management & Compliance Professionals - Opsfolio.com. Copyright © 2017 by Netspective Communications LLC

Yes!!! It means “attempting to identify and then manage threats” which could severely damage or shut your business down.
Organize
Get the right
people involved
Collect
Get the
right data
Analyze
Map your risk
Plan
Mitigate
your risk
Execute
Introduce the
right tools and
processes
Communicate
Informs travelers,
Inform yourself
Audit
Keep the
program alive
and relevant

ARE YOU AWARE of the types of data at risk?
Check it out…
Protected Health
Information (PHI)
Personally Identifiable
Information (PII)
Payment Card Industry
(PCI) Transactions
Intellectual Property

10 MAJOR THREATS affecting your mission critical data?
Malware/
Ransomware
Computer Virus Rogue Security
Software
Trojan Horse Computer Worm
Malicious Spyware Botnet Spam Phishing Rootkit

Most of these threats use “THIRD PARTIES” as their spreading channels.
Unfortunately, depending on third parties is unavoidable. Your
business needs software, hardware, internet connectivity, power,
and buildings. It’s unlikely they’re going to do all these things
themselves. This means that businesses must be depend on third
parties. With this dependence (Third Parties), comes risk.

Is your company’s welfare and reputation at the mercy of a third party?
If YES, then you are exposed to the below consequences.
Regulatory
Fines
Civil Litigation Loss of Value
Damage to Your
Reputation
Market Drift and
Competition
Shifts

See what these cyber experts say about the need of a
TPRM program?
Ryan Stolte
@CyberStolte
CTO & Co-founder of
Bay Dynamics
“Instead of trying to boil the ocean, keeping tabs on every user for every
vendor, security teams must hone in on those that access the company’s
most valued applications and systems.”

Asher DeMetz
@SungardAS_PTNR
Manager- Security Consulting
Sungard Availability Services
“When it comes to the cyber world, vendors must demonstrate that they understand
security and have a mature security program in place, including policies and employee
training. The software or hardware would need to be validated with the correct security
controls and attestation of security testing, and possibly compliance. If the third party is
making configuration changes, these would have to go through proper change-
management channels to ensure that they align to the security program and don't
introduce risk into the environment.”

Below are the ESSENTIAL ACTIVITIES needed to implement
your TPRM Program.
Build a Core Team
Build an initial organization structure and architect a third party
solution adapted to the organization’s operational structure
Seek detailed information to build a complete inventory of all third
and fourth parties from, at minimum, Procurement, Accounting,
International Operations and the Legal departments.
Complete a Full
Inventory

Define a Repository for
Contracts Administration
This database is usually held under the supervision of the
Procurement function and may already exist.
This template must include, among other clauses, a ‘right to audit’
clause that ensures the outsourcer’s ability to perform a security
assessment of its third parties.
Define a Standard
Contract Template
Define a Security
Requirements Appendix
This will be a mandatory attachment for the standard contract
template that will address specific company security requirements
that third party service providers must meet.

Identify a TPRM Risk
Management Software
Platform
Options include leveraging a common system with Procurement for
contracts and third party inventory management or using a
separate Governance, Risk and Compliance (GRC) platform.
This individual will be responsible for acting as the third party
interface for all communications and ensuring third party
performance commitments are met, as well as for maintaining the
overall health of the relationship.
Identify Business Unit
Vendor Relationship
Managers (VRMs)
These should be tailored for each of the key stakeholders in the
company and used and updated on an ongoing basis.
Develop TPRM
Training Materials

Develop a Third Party
Risk Categorization
Process
This is required in order to define, identify and document the risk
associated with each of the organization’s third parties, as not all
represent the same risk to the company, and to ensure that those
third parties that represent the highest risk are focused on first and
in the greatest depth.
This will serve as the repository of all identified third party issues,
including the tracking or remediation plans status, as well as
documentation of any risk acceptances signed off by the business
where remediation will not occur.
Develop or Leverage
an Existing Issue
Management System
Implement the TPRM
Program in Phases
Initially, focusing on program implementation for new third parties
being on boarded can allow the organization to ease into the
implementation process and limit the growth of non-compliant,
high risk third parties within an organization.

An effective third party risk management (TPRM) program will make your business secure.
Netspective’s Opsfolio Attest provides companies with third-party
risk management (TPRM) services that help them identify third-
party risks.

Sources:
https://blogs.cisco.com/smallbusiness/the-10-most-common-security-threats-explained
https://sharedassessments.org
https://bryghtpath.com/why-your-company-needs-a-third-party-risk-management-framework/
https://www.bing.com/images/discover?FORM=ILPMFT
https://images.google.com/
Opsfolio Attest services include:
v Current state assessment and gap analysis based on leading practices.
v Asking and managing risks around third-parties and vendors.
v Detailed risk assessment of specified risk parameters.
v Running third-party audit programs across operational, information security, and compliance risk, etc.
v Offering in-depth third-party risk reports.

These are the OKRs for this PPT:
1. KR-OCMGH-C-04: Using infographics, images and videos to get better visibility in search engine rankings to increase signups.
2. KR-OCMGH-C-01: 50% increase in followers, likes, shares to increase community membership signups.
OKRs

Why does-your-company-need-a-third-party-risk-management-program

Recommended

Recommended

More Related Content

What's hot

What's hot (19)

Similar to Why does-your-company-need-a-third-party-risk-management-program

Similar to Why does-your-company-need-a-third-party-risk-management-program (20)

Recently uploaded

Recently uploaded (20)

Why does-your-company-need-a-third-party-risk-management-program