What is Third Party Risk Management (TPRM)? 

A third party security breach can be devastating for a company and its customers. When one of the organization’s third parties – whether it’s a vendor or a supplier – experiences a cyber security breach, their customers are exposed as well. It’s a frustrating time, especially when security leaders and teams are doing all the right things to build cyber resilience and minimize known security risks. When SOC and DevOps teams have to triage security events because one of their vendors has disclosed a security breach, it causes disruption and unplanned work in order to manage the new risks of a third party-related cyber attack.

With third party security breaches on the rise, security leaders can no longer leave it to traditional methods to assess vendor security, which fail to capture the risks associated with new and existing vendors. In order to manage third party security risks, third party security standards must be enforced within the entire organization.

A third party risk management program establishes those standards, and security leaders are appointed to enforce those standards as they relate to third party security.

According to researchers at Gartner, 80% of legal and compliance leaders reported they could only identify third-party risks after initial vendor onboarding was completed. Unfortunately, that often leaves the company in a legally binding contract with the vendor, regardless of the findings. When it comes to security, assessing third party risks before contracts are signed is the ideal strategy. That pre-qualification step is mission-critical to managing third party risks – hence driving the need for an established third party risk management program to set vendor assessment standards for enforcement throughout an organization.

What is Third Party Risk Management (TPRM)?

Third Party Risk Management (TPRM), or vendor risk management (VRM), is a part of modern-day cybersecurity risk management practice that focuses on identifying and mitigating risks related to third parties. Third parties are commonly referred to as vendors, suppliers, contractors, service providers, and partners. Examples include a law firm, a vendor selling office equipment, a financial consultant, an outsourced software development company, a cyber security service provider, etc.

Working with a third-party vendor introduces new risks for any business. During an organization’s engagement with a third party, they might have access to sensitive data or provide a vital service for the business. Third-party risk management helps organizations monitor and assess the risks introduced from third parties. This helps identify the areas where risks exceed the threshold set by the company. Subsequently, risk-informed decisions can be taken to reduce third-party risks to an acceptable level.

Why is Third Party Risk Management important?

In today’s era of digital automation, third parties are crucial to the success of modern businesses. Irrespective of their sizes, organizations increasingly rely on a number of third parties for growth, innovation, digital transformation, and cybersecurity.

However, relying on third-party vendors without checks and balances can be risky. A third party’s risk posture will contribute to an organization’s risk posture. Moreover, third parties have become a high-value target for cyber criminals in recent years. As seen over the years, third-party incidents can be costly, and recovery from the losses difficult. Third-party risks can potentially lead to cybersecurity threats, disruption in the supply chain, reputational damage, regulatory proceedings, and financial losses.

When TPRM becomes a part of an organization’s overall risk management framework, it enforces discipline in the vendor selection process. As a result, an organization conducts a thorough due diligence exercise before establishing a business relationship and sharing sensitive information. TPRM exercises can also be undertaken during an existing business relationship with a vendor. An organization’s TPRM program is a key indicator of the maturity of its security program.

Many leading regulations and standards require organizations to conduct third-party risk management as one of the compliance requirements. For example, to comply with the HIPAA security rule, covered entities must be aware of risks to critical information stored within their systems and third parties accessing ePHI (electronic personal health information). PCI DSS requirements include a dedicated supplementary document requiring an organization’s vendors to comply with applicable requirements.

Challenges in Third-Party Risk Management

Usually, vendor risk management is considered a time-consuming exercise for already overworked teams. The tasks involve sending emails to collect information, gathering spreadsheets, and managing siloed tools for risk management. These exercises often fail to keep up with the growing number of third-party vendors that an organization relies upon for daily operations.

Some of the most common challenges faced by organizations with ad hoc risk management practices in place are:

1. Scalability Issues: Internal teams cannot efficiently look after third-party management with open source tools that are not scalable. This can lead to increased risks or existing risks being overlooked.
2. Manual Processes: Without automation, manual processes can consume substantial time to identify and address issues.
3. Siloes: Siloed information on risk management can create difficulties for internal teams to assess on an organizational level.
4. Disconnected: Third-party risks are not prioritized while onboarding a vendor or when requirements change during a vendor engagement.

Challenges in Third-Party Security

With increasing security compliance requirements, security teams have additional responsibilities due to vendor engagements. Security teams must be familiar with the relevant components of a vendor’s IT infrastructure, vulnerabilities, and breaches disclosed. They also need an experienced resource that can be responsible for managing remote access to your IT assets and data. Access to third-party vendors should only be granted when required using the principle of least privilege, and this access must be strengthened with additional security layers such as multi-factor authentication (MFA).

What are the questions to ask in a Vendor Risk Assessment?

When conducting a vendor cybersecurity risk assessment, the following questions can help determine the level of risk they might pose to the business. While this list may not be exhaustive, it can build the foundation for a preliminary questionnaire to gather information on a potential new vendor’s risks before onboarding begins.

• What is the history of the vendor company? Who are the individuals responsible for the company leadership?
• What is the nature of the service being provided by the vendor?
• What type of data will be accessed by them to provide the service?
• Do they work with fourth parties that might lead to delivery challenges?
• If the vendor is providing a mission-critical service, is a backup vendor required?
• What is their security breach history?
• Have they been victim to a cyber attack(s)? If yes, when? What steps were taken to remediate the breach?
• Is a third-party vendor bound by existing laws to disclose security breaches?
• Have they undertaken any SOC 1 or SOC 2 audits?
• What are their current security practices? Do they comply with standards such as ISO 27001?
• Has an external third party audited them for their compliance with a standard or regulation, such as an certified PCI DSS ASV?
• Do they have a business continuity management system in place?
• Do they comply with laws and regulations applicable to your organization?
• Have they been previously fined for non-compliance with applicable laws?
• What is the financial stability of the vendor company?

What is the Third Party Risk Management lifecycle?

A comprehensive third-party risk management lifecycle can be illustrated into the following nine phases.

Initial Assessment: Before formally onboarding a third-party vendor, an initial risk assessment must be conducted. This risk assessment’s results should be considered inputs for an informed decision-making process. Additionally, publicly available information about the vendor can be used to get a broader picture. These exercises will prevent an organization from unknowingly introducing an undesirable risk to your risk management framework. Often, a company can present a security certificate from penetration testing company, like BreachLock, demonstrating they meet vendor assessment requirements for third party security.

Tier: Consider adopting a tiered approach for conducting risk assessments for services provided by third-party vendors. This approach will only apply to the vendors that have completed the onboarding process. A third party’s tier dictates the frequency and type of assessments required. For instance, suppliers and vendors critical to online business operations will be placed under Tier 1.

Onboard: Once the initial risk assessment has been conducted and the vendor is approved to proceed, the onboarding process can begin. For security risk management, vendors should provided appropriate levels of access and work with the identity and access management (IAM) program. Here’s where the principle of least privilege becomes a critical risk management strategy that can help prevent third party security incidents. Credential authorization and access should only be given by designated system adminstrators responsible for third party vendor access and vendor onboarding and offboarding.

Assess: Once under contract, third-party vendors in the upper tiers of your tiered approach should have regular risk assessments conducted according to the TRMP. These risk assessments must be based on the nature of a vendor’s service(s). However, security and financial risks should be considered for all vendors by default. Beyond these risks, a component manufacturer will have additional risks pertaining to health and safety. Vendors in both the physical and digital supply chain will have additional security requirements to fulfill. The cadence for third party risk assessments must be dictated by the TPRM. Most companies with compliance requirements have to annually conduct security testing. These security reports can be shared with clients to fulfill their third party vendor assessment requirements (i.e., SOC 2, ISO 27001, etc.).

Generate findings: When a risk assessment is completed, identified issues or findings can be shared with the vendor to respond. You may receive responses from third-party vendors that are either incomplete or unsatisfactory. Moreover, data collected from external sources about a vendor’s security posture or financial stability must be considered here.

Remediate issues: In this phase, the vendor addresses the identified issues or findings and mitigates the risk. However, organizations should be prepared that there can be a period where the discussion goes back and forth on risk assessment findings and responses given by the vendors. As a matter of good practice, you should maintain a record of the communication for future reference.

Report risks: Once risks have been identified, analyzed, and mitigated, the entire process and outcomes should be documented as a presentable report. This report must be made available to the relevant stakeholders so that they have the visibility they require.

Monitor: Risk management is not a one-time exercise. Third parties should be continuously assessed at regular intervals. Frequent assessment of third party vendors ensures a mechanism is in place to monitor them for any risk posture changes. Any changes in the service(s) being provided or the underlying environment must be followed by an assessment and tier change if required. Continuous monitoring also helps organizations avoid dealing with undesirable risks.

Retire: If your organization decides to conclude the contract with a third-party vendor, a formal process must be in place to retire third parties, remove access, and ensure that data that must not be stored with them is deleted permanently.

Security Risk Management of Vendors, Suppliers, and Business Partners

Security leaders can manage third party security risks in advance of signing vendor contracts by working to establish or meeting the requirements of the TPRM. Often, governance, risk, and compliance (GRC) requirements for third party risk management have tactical requirements for security teams, such as gathering vendor assessments. These proactive measures can help organizations prevent expensive, impactful breaches that cause downstream impacts on their customers and their customers.

With the cybersecurity breaches in 2022 still impacting security in 2023 – specifically regarding the digital supply chain – the focus on third-party risk management and conducting due diligence exercises for external vendors has never been more critical. It’s certainly easier to keep insecure vendors out of the network instead of managing unknown third party risks. Establishing a TPRM program with a vendor assessment process in place can help security leaders verify if a vendor’s security standards meet an organization’s risk tolerance. This preventative solution offers potential vendors and suppliers the opportunity to demonstrate their security program meets their customer’s third party security standards before legally binding agreements are signed.

Types of Third Party Security Risks

Strategic risk: When third-party engagements are not aligned with an organization’s objectives, they can directly impact the business strategy. Continuous monitoring of third-party engagements ensures that strategic risk does not result in compliance risk and, in some cases, financial risk.

Reputation risk: There is no denying that data breaches affect a service provider’s market reputation. From Marriott to T-Mobile, corporate buyers are paying attention to security breaches in the supply chain – and they are taking their dollars elsewhere. As an organization continues to work with an affected third-party vendor, a security breach can lower customer trust and the reputation of any business simply by public association. In today’s economy, insecure suppliers and vendors are not worth the cost of reputational risk.

Operational risk: Organizations rely on various third-party applications and services for their day-to-day business operations. Even though there can be a service level agreement in place, any operational lapse due to a cyberattack or otherwise can lead to data loss, operational interruptions, and privacy violations for an organization.

Transaction risk: When expecting the delivery of a product or service from a third party, any last-minute changes can result in transactional issues within the organization.

Compliance risk: Regulations and standards across different jurisdictions have started incorporating third-party risk management as a compliance requirement. Therefore, an organization-wide risk management program must address risks introduced due to the involvement of third parties in involved in business operations.

Information security risk: Irrespective of the nature and amount of data accessed by a third-party, security risks arise when third parties are allowed to access your organizational data, systems, and digital infrastructure. Examples of these security risks include modification, disruption, destruction of data, or unauthorized access to data.

Financial risk: Working with a financially unstable third party can lead to disruptions in the supply chain. A third-party undergoing financial struggles, being acquired, or declaring bankruptcy may not allocate an adequate budget for implementing security practices. Therefore, transitioning to a financially stable third-party vendor while offboarding that type of third party is always advisable. Discretion with the existing vendor may be required to avoid unnecessarily increasing security risks while the vendor transition and offboarding are both completed.

Benefits of Vendor Risk Management for Third Party Security

An effective vendor risk management program gives an organization complete visibility into its third-party engagements, including third party security. A formal risk assessment process with third party security requirements for due diligence before the contract is signed is ideal. This minimizes encountering any surprises after the engagement has started. Standard terms are used throughout the vendor assessment process, and ambiguity in the oral discussions and formal documentation is reduced. Many times, contracts are concluded without any formal offboarding process in place. An effective vendor risk management program solves this problem by defining how the relationship would end.

Conducting third-party risk assessments results in consistent performance that aligns with compliance and security goals. Organizations are better placed to execute strategic and project-level objectives. Operational efficiency improves over time, and unexpected business disruptions are prevented. If at all there is a disruption, ready-to-use tools are available to recover swiftly from such disruptions. While overall security posture improves, customer trust and experience improve alongside. All of these improvements also contribute to increased revenue and profitability while minimizing the risks that cause preventable security breaches.

Vendor Assessments for Third Party Security

Often, a third party is tasked with assessing itself to meet third party requirements for it’s customers, prospective customers, or partners. To achieve those outcomes, often a third party penetration test conducted by a certified third party security provider can fulfill the requirements.

BreachLock can assess vendor security with our award-winning, analyst-recognized, expert-led pen testing as a service, featuring vendor assessments for PCI DSS, GDPR, or HIPAA compliance, SOC 1 and SOC 2, and more. A vendor assessment can help you demonstrate your organization has successfully met a thorough third party security and compliance assessment delivered by a trusted, certified penetration testing company. Schedule a discovery call with one of our security experts to see how BreachLock’s third party vendor assessment and security testing services can work for you.

Managing vendor assessments is complex, especially when time and manual efforts can slow down third party security.

With new regulations, rising cyber threats, and an increased reliance on outsourcing business activities to third parties, it’s critical for organizations to assess third party vendors and suppliers to support the third-party risk management (TPRM) program.

The bottom line is that an immature TPRM program can cost organizations money, time, and ultimately, increase the risk of reputational damage from third-party incidents.

Learn how BreachLock can help you assess enable your organization to streamline manual processes throughout the third party security, helping to improve productivity, reduce unnecessary costs, and create greater visibility into risks, including how to:

• Streamline processes across multiple teams and systems
• Reduce third-party blind spots and uncover hidden risks
• Enable quicker, more systematic third-party vendor assessments
• Respond faster when business resilience issues arise
• Inform decisions with data throughout the third-party lifecycle