As digital connections between businesses, suppliers and customers have grown deeper and more frequent, the risk of data breaches and cyberattacks spreading via those connections has escalated.
Some of the biggest data breaches in history have taken place over the past year at high-profile organisations and their full impact is still coming to light. Likewise, regulators such as the Information Commissioner’s Office (ICO) have started to issue unprecedented fines to organisations that are judged non-compliant with security and data management standards.
Go deeper with GlobalData
At board level, for perhaps the first time, the relationship between cyber risk and business risk is becoming clear: cybersecurity and compliance failures have the potential to directly affect not just business continuity, but also the reputational, financial and legal position of the organisation.
As a result, businesses must evolve security strategies and compliance approaches to meet regulatory requirements.
However, it’s not just their own performance that must be strengthened; their supplier network has to be up to standard, too. New regulations, such as GDPR, and guidelines in sectors from finance to healthcare, make it clear that businesses are accountable for their decisions when choosing to work with a third party. And there’s good reason for regulators to be focusing on this issue: according to Ponemon Institute research, 59% of organisations have suffered a breach caused by one of their vendors or third parties.
As the platform-as-a-service economy comes of age, third-party risk management is emerging as a defining challenge. So how can businesses manage third-party risk and still achieve commercial goals?
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataBefore the engagement – set your risk appetite
Risk is inevitable and some must be accepted if a business is to function effectively.
However, some risks are more critical to businesses than others. Identifying what these are, how to address them, and what resources should be allocated to them sets an organisation’s risk appetite and allows it to take a risk-based approach to supplier engagement.
For example, given the current regulatory climate, the risk of data breaches and their consequences is high, therefore the organisation should have very low appetite for risks associated with data security and a willingness to commit resources to reducing them. Once this appetite is established, it sets the tone for engagement with prospective third parties.
Objective and subjective due diligence
In a typical enterprise there are a huge number of suppliers to be screened – Ponemon Institute research estimated that the average organisation shares sensitive data with 583 partners – so it’s useful to apply proportional due diligence to make sure resources are focused in the right place. Before you screen a prospective partner, establish what level of access they will have to your networks and data and set the level of due diligence needed accordingly.
Due diligence has objective and subjective elements. Objectively, you can verify whether the company has achieved security standards such as NCSC, NIST and/or ISO accreditations, and any relevant to your sector, such as HIPAA for healthcare. Business risk intelligence research should uncover any historical security issues at the company that might be red flags.
These objective checks are important for compliance purposes and a good starting point for due diligence, but they don’t necessarily indicate the company’s dynamic approach to ongoing risk management. This requires more direct interrogation and a subjective assessment of the responses in light of your risk appetite.
Your supplier questionnaire should ask for details on how the company manages its security. Consider including questions such as: When was the last penetration test? What were the last five security incidents experienced and how were they addressed? What security controls exist for users?
The answers – and the level of detail provided – give insight into the maturity of the company’s security posture and how it is adapting to the changing threat environment. Once this is known, you can assess its performance to decide if it meets requirements.
Throughout the due diligence process, it’s important to get a sense of the supplier’s own risk appetite. If it diverges significantly from your own, that’s a strong indication that this is not a suitable partner for your organisation.
Plan proactively for breach incidents
What happens when you’ve engaged with a supplier and they subsequently suffer a breach? It’s important to agree an incident response plan in advance. This should include breach notification within an agreed timescale and the remedial actions to be taken by both parties, such as blocking network access.
Being proactive and transparent here pays dividends, not just in containing a breach from a security perspective, but also during post-breach compliance analysis by regulators.
Monitoring third parties – more than a point in time tick-box exercise
Even if a supplier passed due diligence last week, that doesn’t mean they are still secure and compliant this week. The threat environment changes all the time, so ongoing monitoring is essential to identify emerging threats.
Business-critical suppliers should be on the watchlists of threat intelligence analysts as part of the company’s continuing assessment of its risk posture. Attacks, or threatened attacks, on third parties identified through threat intelligence analysis can be mitigated as soon as possible to limit exposure until the threat has been addressed.
Meeting regulations – meaningful metrics and intelligence
An important part of meeting regulations is being able to demonstrate that a risk management programme is not just in existence but is understood and endorsed at board level. Key to this is regular reporting that links cyber risk to business risk. Clear metrics and intelligence around emerging risks and threat levels need to be included in board packs so directors are fully informed and can make governance decisions accordingly.
The high volume of recently implemented regulations, from the GDPR to a raft of financial sector guidelines on outsourcing, leave no doubt that third-party risk management is one of the biggest challenges facing today’s interconnected companies. There is strong emphasis on risk monitoring and proof that businesses are responding appropriately to the changing environment. This will require businesses to draw on real-time risk intelligence to ensure that their third parties don’t introduce unacceptable risk into the organisation.
Finally, compliance is by no means a guarantee of security – in fact, some regulations have not been updated for a considerable time, while the threat environment changes daily.
However, by adopting a robust approach to screening third parties for security and compliance risk, and following this with ongoing monitoring of third parties and related emerging threats, the organisation should be able to achieve its commercial goals while still satisfying an appetite for risk reduction.
Read more: A roadmap to reduce security analyst fatigue in security operations centres
