Companies trust vendors in many critical areas (external services, external whole IT, software, data storage and systems. They entrust them with their critical data and give them access to critical data. A leak at a supplier is a leak at your company. This is what many have already found out. So you should know: can they be trusted? Why? Why not? What to do about it? You are the one who must answer these questions and take action.
Third-party risk management is difficult. It requires a lot of transparency, clear accountability and good cooperation. In doing so, accountability is blurred: is it still in IT, security, or prosecution? And it has to be achieved with hundreds and sometimes thousands of organizations, being an „outsider” for each of them. Even dozens of supplier companies or even a dozen is a problem. On top of that, you have a limited number of people and resources. NIS2 also imposes its own requirements. NIS2 explicitly says that supply chain risk is part of mandatory cyber risk management measures.
This need to get really good at risk management, operating from the outside and with few resources will lead to big changes. The most important of these is the development of risk assessment based on machine learning and artificial intelligence. Such solutions will emerge in the area of third-party risk, and then companies will start using them for internal risk assessment as well. Need breeds invention, and here the need is really urgent.
Third-party risk management is a way to hold companies accountable for good risk practices. When you raise the level of risk management at your suppliers, you strengthen the security of your entire system. This reduces the risk of data leakage and the possibility that systems taken care of or provided by third-party vendors will be used as points to circumvent your protection mechanisms. Working on third-party risk, is working for the common good.
At most companies, TPRM (Third-Party Risk Management) still looks the same: once a year a survey, some Excel, „ticked off.” This model no longer works. Piotr Olszewski our CTO and risk management specialist, and author of Risk Analyzer, says that clients can maintain their procedures and continue to rely on forms filled out by suppliers, however, he recommends as in the case of risks to monitor this on a continuous basis. And for that, you already need complete TPRM systems and an appropriate ranking method.
Some numbers that give food for thought:
- 71% organizations still use own customized questionnaires. The „for all” standard does not exist in practice.
- The scale of work of the position responsible for analyzing suppliers: in finance 1 analyst serves an average of 73 suppliers, and in technology companies even 133.
- A small portion of the portfolio goes into permanent custody: on average 11.7% suppliers, with the medical sector declaring 19%, a finance/insurance 13%.
- The contracts are „embraced” on paper: approx. 90% requires security obligations, audit rights and incident notification.
Most interesting, however, is where the change begins.
In my opinion, the model of „attestation once in a while” must at least be confronted towards a continuous insight into supplier evaluation (continuous surface risk assessment). This is not yet a standard - the practices involved have adoption of the order of 27% (In Poland, the financial sector performs best).
According to our CTO, the logic is simple: the survey says what the supplier declares, and data from the TPRM system verify this declaration and do so on a continuous basis.
Recommend action on its own third-party risk management program (even a small one):
- Use the buying moment as leverage to verify the supplier with both your methods and the TPRM system
- Renewal/extension of the contract only after closing significant problems.
- Take care of this process and create it if you don't have it
- Allocate responsibility, e.g., based on the data, the prosecutor can reject the „best offers” because the risk factor for that supplier is important
- Review reports as an additional source of information about risks even those you don't expect.
A question for you: how much „live” supplier monitoring do you have today, and how much is still based on an annual declaration in Excel sheets or PDFs?
Need a security audit of your suppliers' portfolios? Consult with an ISCG expert: https://outlook.office.com/book/MeetingswithISCGExperts@ISCG.onmicrosoft.com/s/4OIyaXg2FECLomR4u85ATw2?ismsaljsauthenabled