Best Practices for Trusted Third-Party Risk Management
Third parties are a necessary part of your enterprise. They are your vendors, your suppliers, your contractors, and your partners. Without them, you can’t do business. Third parties provide cloud services, store sensitive data, and provide other important services.
Unfortunately, third parties are also a major source of cyber risk. Cybercriminals often target third-party providers to target their clients’ data and networks, such as the notorious SolarWinds breach at the end of 2020. To move your business forward and propel growth, you need to be able to trust your third parties and their security posture.
For this reason, Third-Party Risk Management (TPRM) is critical for every organization.
What is TPRM?
Third-party risk management, or TPRM, is the process of vetting your vendors so that you can understand the risks they may pose to your organization and the supply chain itself. Organizations with strong vendor risk management programs systematically identify, assess, and mitigate threats to their assets and data that might be caused by the organization’s supply chain.
Most organizations do business with a number of third parties, and those third parties fill many roles. In fact, Gartner found that 60% of organizations work with over 1,000 third parties. Some are vendors, but others fall into different categories, such as partners, contractors, and consultants. Therefore, TPRM is an umbrella that covers VRM as well as other kinds of third-party risk management, such as: Supplier Risk Management, IT vendor risk, anti-bribery/anti-corruption (ABAC) compliance, and contract risk management, among others.
Why is third-party risk management important?
It’s never good news when third parties are involved in a data breach; Ponemon’s 2021 Cost of a Data Breach Report found that if a software vulnerability at a third party causes a data breach, the cost tends to increase by more than $90,000. That’s not great; most data breaches are already steep at an average of $4.24 million.
Third-party breaches are becoming increasingly frequent, however. According to InfoSecurity Magazine, 44% of organizations were found to have experienced a security breach in the last year. Of those companies, 74% said that the breach occurred because too much privileged access had been given to third parties.
That’s the problem, however — often third parties need access to your systems and data to be effective, but you don’t have the same control over your third parties as you do your own employees. You can’t require the employees or contractors of another company to adhere to your own standards — but if your customers’ data is exposed because of a third-party, that breach is still your responsibility. So how can you trust your third parties with your data?
Best practices for third-party risk management
1. Know who your third parties are
Before you can determine risk, you need to know who all your third parties are and understand exactly how much is being shared with each.
This isn’t always easy. While some large vendors — like cloud providers — may be well-known third parties, some departments (and even some individuals) may be working with their own third parties, and may not have shared their vendor list with other departments. They might not even think of some contractors as third-party vendors, so you’ll have to work with each department to develop a list.
Once you know who your vendors are, it’s important to know what data and networks they’re able to access. Do they need the level of privilege they have? If not, you’ll need to set some limits.
Tip: Follow the money! One way to begin identifying your third parties is with your finance department. Third parties are typically paid service providers and if you follow the money you will probably uncover vendors you didn’t know about.
2. Prioritize your vendors
Not all vendors were created equal, or at least they don’t all pose the same risk to your assets. Vendors that handle critical business processes will be a much bigger threat to your data than a contractor who works with one department. You’ll want to be able to see, at a glance, which third parties represent the biggest risks to your organization. Risk ratings are a tool that can help you do this.
Your first step is a risk analysis for each of your vendors. Use the following formula to understand each third parties’ risk:
Risk = Likelihood of a Data Breach X Impact of a Data Breach/Cost
Then, based on the results, prioritize your vendors by assigning a risk rating of high, medium, or low. Often the vendors who handle the most business-critical operations or the most sensitive data will likely be rated medium or high. Be aware that this method sometimes won’t give you all the information you need, because sometimes you can’t know the vendors’ likelihood of experiencing a breach. They may not be aware, either — some of their assets may be insecure, or they may have been breached and not yet know.
3. Monitor your vendors continuously
Questionnaires and surveys represent one moment in time. These tools are static, and provide snapshots of a vendor’s security posture, but rarely the whole picture. In many cases, there’s no way to verify the accuracy of questionnaires, and you may simply have to accept a third party’s word that they are compliant.
By using tools that allow you to continuously monitor the security posture of your vendors, you can avoid all of these issues, receiving a notification whenever a vendor falls out of compliance, and scanning for problems the vendor might not know about, like an Amazon Web Services bucket that has been mistakenly configured, chatter on the dark web about breached assets, or other assets that have been left unsecured.
Tip: Increasingly, regulatory bodies are mandating continuous monitoring of third parties and vendors. Make sure you’re up to date with your industry’s mandates (NYDFS, CMMC, Executive Order on Improving the Nation’s Cybersecurity) and stay ahead of any potential changes that will require continuous monitoring of suppliers.
4. Automate the process
When it comes to reducing third-party risk, due diligence can be both tedious and labor-intensive.
Large organizations often work with hundreds or even thousands of third parties, ranging from cloud vendors that serve an entire company to contractors that work for just one department. It’s a lot to keep track of — especially since many companies are still using spreadsheets and other manual tools to track TPRM. Estimates vary, but research from Ponemon suggests that 40% of organizations use spreadsheets to track issues with third parties’ risk. This is a manual process that takes a lot of time, and — as with any other manual data-entry project — can be prone to human error.
Automated tools reduce the paperwork and strain on staff by offering a way to easily monitor third parties without having to manually create questionnaires, or update spreadsheets. It’s worth mentioning that vendors often have questionnaire fatigue — they have to fill out many security questionnaires for their clients and may simply be copying and pasting answers to save time. Automated tools can cut down on the administrative work on their end as well.
Tip: Automating third-party risk management processes will not only save you time but money. Need help justifying the need for tools that will automate your TPRM process? We’ve seen that organizations reduced the vendor questionnaire effort by 83% and received an ROI of 198% through automation.
5. Collect consistent data
Automated tools can also solve another questionnaire-related problem. Often, when presented with a questionnaire, third parties may choose to answer a question differently.
Some may take a narrative approach to answering questions, some may answer yes/no, some may attach a screenshot. Those different kinds of data are going to be difficult to store or understand because in many cases you won’t be comparing apples to apples. Nor can a tool automatically process all those different kinds of data — instead, someone will have to manually review it.
An intelligence security tool can collect the data itself, only collecting the sort of structured data you need to automatically assess risk. It will also save people on both sides of the client/vendor relationship time and effort on questionnaires and surveys.
How can SecurityScorecard help?
You can never eliminate risk, but you can manage it, and that’s important when you need to trust your third parties. To reduce the amount of administrative time and effort spent managing third-party relationships, consider an intelligent tool that automates parts of the third-party management process.
SecurityScorecard enables organizations to drive scalable and automated third-party risk management to drive a trusted third-party risk management program. SecurityScorecard is the only omni-directional security ratings provider of cyber risk ratings, questionnaires, a marketplace of integrations, and attack surface intelligence.
