Are You Risk Aware Voss Sukolics DATCON2024.pdf

DATCON '24 NEXT

Are You Risk Aware?

Third-Party Risk Management

Dr. Erika Voss, PhD
VP Information Security
DAT Freight & Analytics

Vanessa Sukolics
Head of Risk and Controls
DAT Freight & Analytics

What is Third-Party Risk Management?

The process whereby companies monitor and manage interactions with all external parties with which it has a relationship.

This may include both contractual and non-contractual parties.

Key words:
“External”
“Monitor”
“Manage”
"Due Diligence"

Caring is sharing

Know your vendor’s security posture
• It is key to impacting or damaging yours

Protect your business financial health
• Anticipate the before
• The “What If” game matters

Comply with regulations
• PCI, HIPAA, NYDFS, CCPA, GDPR

Protect your company’s reputation

• Stock price
• Customers

Knowledge

Scope and get
Scope and get leadership buy-in for your TPRM program

Identify and understand
Identify and understand types of third-party risk

Implement
Implement TPRM across your organization

Maintain and monitor
Maintain and monitor your TPRM program

Third-Party Risk Management Lifecycle

Vendor Identification
Evaluation & Selection
Risk Assessment
Risk Mitigation

Contracting &
Procurement
Reporting & Record Keeping
Ongoing Monitoring
Vendor Off-Boarding

Building a Third-Party Risk Management Program?

Identify, assess, and control the risks and interactions with your company

Think procurement
Think offboarding

Comply with regulations

Protect confidential information (PII, PHI, PCI)

Strengthen your supply chain – the first or second tiers

Handle disruptions – exercise the plan

Identify the types of third-party risks

• Cybersecurity risk
• Operational risk
• Compliance risk
• Reputational risk
• Financial risk
• Strategic risk
• Geopolitical risk
• Supply chain risk - NEW

Alignment

Align with your Executives on your organization’s risk appetite and establish a shared definition of third-party risk.

Why is it important to them?

Correlate your third-party risks to broader enterprise risks:
• Reputational loss
• Regulatory fines
• Brand damage

Accuracy Matters

• What are the goals of your TPRM program?

• Do you have specific compliance requirements or deliverables (i.e. for publicly traded companies or regulated industries)?

• What risk domains should be managed (i.e. InfoSec, privacy, financial, reputational)?

• What is the organization’s appetite for risk?

Create effective, efficient assessment processes

What type of services are they providing?

What data do they have access to?

Will they process or host any of your data?

What functions or teams rely on the third party to operate?

What are the costs and terms of your relationship?
(i.e., contractual, subscription, one-time project)

Are there any integrations between your systems?

Will they be embedded into your product?

Can they show certification or compliance with security regulations?

What type of risks do they pose?

How critical are they to your organization?

Exercise, exercise, exercise

Table-top exercises matter

Discuss with both your business partners and your executive leadership team

Continuous monitoring

Go deep into your supply chain; it matters

Capture the risks

Account for third-party risks in your GRC program

Now what?

  1. Adopt best Practices
  2. Manage and Assess Third-Party Risks
  3. Conduct Third-Party Screening, Onboarding, and Due Diligence
  4. Focus on Fourth Parties
  5. Establish a Tone at the Top with Board-level oversight
  6. Focus on IT Vendor Risk
  7. Ensure Appropriate Investment and Staffing
  8. Evaluate if the TPRM Program is Effective
  9. Build Mature TPRM Processes
  10. Leverage Tech

Key takeaways

73% of organizations have moderate to high level dependency on service providers

800 companies were surveyed across the US; 37% responded with their programs for TPRM aren't established or consistent

Only 54% of companies across the globe make TPRM a part of their broader Cyber Risk Management Program

Be better?

Automating response to third-party incidents

Too many organizations report using manual processes and a complex array of tools to understand and resolve vendor breaches.

Building a single source of truth

More teams are getting involved in third-party risk management, but the use of multiple overlapping tools presents a foggy picture of risk.

Giving up spreadsheets once and for all

Nearly half of companies still use spreadsheets to assess their third parties – and many are not confident in the results!

Remediating third-party risks

The point of a TPRM program is to reduce risk. However, research shows a disparity between the frequency of risk assessments and effective risk remediation.