Jon Siegler
Many cybersecurity professionals, if not all, have experienced that “after the breach” feeling — the moment you realize you’ll have to tell your customers their personal information may have been compromised because one of your vendors had a data breach.
Such situations also involve spending significant amounts of time and resources fixing a problem caused by a third party. No matter how well you clean things up, the reputational hit to your organization will continue to cost you in lost business down the road.
The fact is, the consequences of failing to properly manage third-party risk are far too costly to ignore.
The cost of neglecting cyber risk
Ransomware attacks, data breaches and widespread IT outages ranked this year as the most significant risk concerns for companies worldwide. More than seven in ten organizations fear third parties have too much control over customer data, including needlessly broad permissions and authorization. Of the 44% of organizations that reported a data breach last year, 75% said the breach stemmed from a third party’s excessive privileged access.
While managing third-party cyber risk is essential to maintaining customer trust, it’s also increasingly important for organizations looking to purchase cyber insurance policies. All it takes is an accidental email containing personal information sent to the wrong customer, and the basic standards for a data breach have been met. Add the various state and federal data laws and costs associated with remediation, and it becomes clear why every organization could benefit from cyber insurance.
As more contracts between businesses contain cyber insurance clauses, it’s important to consider the impact security standards have on obtaining a policy. To put it plainly, the better your security standards are, the better your rates, especially at a time when cyber insurance premiums are soaring.
Cyber insurance providers want to see that you have high standards of security before they issue a policy, so effective third-party risk management could mean the difference between potential insurers offering you a good rate or deeming you ineligible for coverage.
How to manage third-party risk
An organization’s ability to handle third-party cyber risk proactively depends on its risk management strategies. According to Forrester, 70% of enterprise decision-makers agree that third-party risk is a business priority, but about 69% use manual processes in their third-party risk programs.
A manual approach to third-party risk management increases exposure to data and privacy breaches, hampers your incident response plans, and ultimately costs you time, money and customers — there’s no time to sift through spreadsheets and email chains when a vendor breach happens.
Using holistic GRC software to manage your third-party risk program centralizes your vendors’ most critical information, enabling your teams to better and more quickly manage cost, performance and exposure throughout each relationship.
Review processes
Since vendors are connected to your organization at numerous points, you’ll need to set common, organization-wide standards for vendor review processes. Without these internal standards, you’ll end up with inconsistent vendor assessments, which could lead to additional vulnerabilities.
First, agree on third-party frameworks and assessment criteria for each type of vendor relationship. Determine whether existing regulatory frameworks like SOC 2 and GDPR, healthcare frameworks like HIPAA, or security frameworks like NIST or ISO will give you the information you need. Then, identify key performance measures, including internal reporting and controls.
By establishing a consistent vendor review process and shared language around risk assessment, your company can ensure all teams approach risk management similarly. Managing your third-party risk with holistic GRC software supports this cross-functional work with transparency and visibility while enabling team members to access the information they need to evaluate risk within their departments.
Prioritization
Your organization likely works with dozens of vendors, and not every relationship will demand the highest level of review. Identifying the vendors most critical to your operations will allow you to focus on the most important reviews.
To prioritize the frequency and extent of review each vendor requires, rank your third-party relationships according to these criteria:
- The scope of company operations potentially affected by a vendor breach.
- The vendor’s level of access to your organization’s networks and data.
- Any fourth parties the vendor uses and those companies’ access to your data and networks.
Continuous monitoring
Most companies review their vendors at the beginning of a relationship and on an annual basis afterward, but a year is a long time in the business world. By the time the next review comes up, your vendor could not be compliant, leaving your company exposed.
Continuous monitoring enables your organization to keep pace with the evolving risk landscape. Using a centralized framework that monitors third-party interactions with your systems simplifies continuous monitoring. Teams can identify and mitigate ongoing cyber risks, draft contingency plans for potential risk incidents, and ensure vendors keep up with changing privacy regulations.
Follow these steps to optimize third-party risk management with continuous monitoring:
- Agree on the processes, technologies, and questionnaires your company will use to monitor vendor changes.
- Identify which company functions should participate in which reviews.
- Specify which stakeholders need to know about vendor changes.
Agreeing on these monitoring aspects ahead of time and on an ongoing basis empowers your teams to act decisively when a problem arises rather than seeking out this information in the middle of an incident.
Take control of third-party risks with better risk management
Because they integrate so seamlessly with many aspects of modern organizations, third-party vendors’ risks are your risks. Data breaches and security failures experienced by your vendors expose your company (and your customers), too. The consequences aren’t just monetary: With each hit, your business risks reputational damage and operational resiliency.
By embracing a holistic strategy to identify and manage third-party risk, you’ll build trust with your customers, bolster your cyber risk posture, and identify problem vendors before they spell disaster.
Comment