Third-Party Information Security Risk Management

Third-party information security risk management finds, assesses and reduces the security risks that vendors, suppliers, contractors and service providers bring when they access an organization's data, systems or intellectual property. A program has five parts: risk identification, risk assessment, risk mitigation, continuous monitoring, and reporting and governance. Assessments use questionnaires such as SIG and CAIQ, audits, certifications such as SOC 2 and ISO 27001, and security ratings. Vendors are tiered by criticality, so high-risk vendors get the deepest assessment and monitoring. Frameworks from NIST, ISO 27001 and Shared Assessments guide the method.

What does third-party risk management cover?

Third-party risk management (TPRM) is the set of processes and controls an organization uses to manage the risks of its relationships with external entities. Cloud services, outsourcing and longer supply chains have widened that exposure. Without a structured approach, organizations face more cybersecurity incidents, data breaches, operational disruptions and reputational damage.

Components of a TPRM program:

• Risk Identification: Proactively identifying potential risks across the entire third-party lifecycle, from onboarding to offboarding.
• Risk Assessment: Evaluating the likelihood and impact of identified risks, often through questionnaires, audits, and security ratings.
• Risk Mitigation: Implementing controls and strategies to reduce identified risks to an acceptable level.
• Continuous Monitoring: Regularly reviewing third-party performance and security posture to detect changes in risk profiles.
• Reporting and Governance: Establishing clear reporting lines and governance structures to ensure accountability and informed decision-making.

How TPRM changed: Vendor management used to focus on contractual and financial terms. Attacks through suppliers, and regulations such as GDPR and CCPA, which hold organizations accountable for the security practices of their third parties, moved the focus to security. TPRM now covers cybersecurity, data privacy, compliance and operational resilience together.

What does a third-party risk assessment framework include?

A TPRM framework gives a consistent, repeatable way to manage third-party security risk across the vendor lifecycle. Frameworks from NIST, ISO 27001 and Shared Assessments can be adapted to an organization's context and risk appetite. A framework has six elements:

1. Policy and Governance: Establish clear policies, roles, and responsibilities for TPRM. This includes defining the scope of the program, risk tolerance levels, and decision-making processes. A dedicated TPRM team or cross-functional committee is often responsible for overseeing the program.
2. Vendor Segmentation and Tiering: Categorize third parties based on the criticality of their services and the level of risk they pose. This allows organizations to allocate resources effectively, applying more rigorous assessments and monitoring to high-risk vendors. Factors for tiering include access to sensitive data, impact on critical business operations, and regulatory requirements.
3. Due Diligence and Assessment: Conduct thorough due diligence before engaging with a third party. This involves security assessments, including questionnaires such as SIG and CAIQ, on-site audits, and review of security certifications such as SOC 2 and ISO 27001. The depth of assessment should align with the vendor's risk tier.
4. Contractual Agreements: Incorporate security clauses and service level agreements (SLAs) into contracts. These should specify security requirements, incident response procedures, audit rights, and liability provisions. Legal review is crucial to ensure enforceability and alignment with organizational policies.
5. Ongoing Monitoring: Implement continuous monitoring mechanisms to track third-party security performance and compliance. This can involve security ratings services, regular vulnerability scans, penetration testing, and periodic re-assessments. Automation makes continuous monitoring practical at volume.
6. Incident Response and Remediation: Define clear procedures for responding to security incidents involving third parties. This includes communication protocols, forensic investigation support, and remediation requirements. Organizations must ensure that third parties are contractually obligated to report incidents promptly.

How do you build a third-party risk management program?

1. Define Scope and Objectives: Clearly articulate what the TPRM program aims to achieve, which third parties are in scope, and the critical assets or data they interact with. This ensures alignment with business objectives and regulatory obligations.
2. Establish a Cross-Functional Team: TPRM is not solely an IT or security function. Involve stakeholders from legal, procurement, compliance, and business units to ensure a holistic approach and buy-in across the organization. Assign clear roles and responsibilities.
3. Inventory All Third Parties: Create a comprehensive inventory of all third-party relationships, including their services, data access, and criticality. Every later step depends on it.
4. Develop a Risk Assessment Methodology: Standardize the process for assessing third-party risks. This includes defining risk categories, assessment criteria, scoring methodologies, and reporting templates. Leverage industry frameworks like NIST SP 800-53 or ISO 27002 for guidance.
5. Implement Technology Solutions: Utilize TPRM platforms or GRC (Governance, Risk, and Compliance) tools to automate workflows, manage assessments, track risks, and facilitate reporting. These tools can streamline the entire TPRM lifecycle, from vendor onboarding to continuous monitoring.
6. Conduct Initial Assessments: For existing third parties, conduct initial risk assessments based on their tiering. For new vendors, integrate the assessment process into the procurement and onboarding workflow. Prioritize high-risk vendors for immediate and in-depth review.
7. Develop Remediation Plans: Work collaboratively with third parties to address identified vulnerabilities and control gaps. Establish clear timelines for remediation and monitor progress. Escalate unresolved issues according to defined policies.
8. Continuous Monitoring and Re-assessment: Implement ongoing monitoring of third-party security posture. This includes reviewing security ratings, audit reports, and incident notifications. Schedule periodic re-assessments based on risk levels and contractual agreements.
9. Training and Awareness: Provide regular training to internal stakeholders on TPRM policies and procedures. Educate employees on their roles in identifying and reporting third-party risks.
10. Regular Program Review and Improvement: Periodically review the effectiveness of the TPRM program. Gather feedback, analyze incident data, and adapt the framework to address emerging threats and evolving business needs. Conduct tabletop exercises to test incident response plans.

What are the common pitfalls in third-party risk management?

• Lack of Executive Buy-in and Resources: Without strong support from senior leadership, TPRM initiatives often lack the necessary funding, staffing, and authority to be effective. This can lead to a fragmented approach and insufficient risk mitigation.
• Incomplete Vendor Inventory: Many organizations underestimate the sheer number of third parties they engage with, leading to "shadow IT" and unmanaged risks. An incomplete inventory makes it impossible to assess and monitor all potential vulnerabilities.
• Over-reliance on Checklists and Static Assessments: Relying solely on annual questionnaires or static security assessments provides only a snapshot of a vendor's security posture. This approach fails to capture dynamic changes in risk and leaves organizations vulnerable to emerging threats.
• Siloed Approach to Risk Management: TPRM often operates in isolation from other risk management functions (e.g., enterprise risk management, compliance). This leads to inefficiencies, redundant efforts, and a lack of holistic risk visibility.
• Ineffective Contractual Enforcement: Even with security clauses, organizations may struggle to enforce them due to a lack of clear metrics, monitoring capabilities, or legal recourse. Contracts must be living documents, actively managed and enforced.
• Ignoring Fourth-Party Risk: Risk extends beyond direct third parties to fourth parties (sub-contractors of third parties) and beyond. A failure to consider this extended ecosystem can introduce significant, unmanaged risks.
• Lack of Automation: Manual TPRM processes are time-consuming, prone to errors, and difficult to scale. Without automation, organizations struggle to keep pace with the volume and complexity of third-party relationships.

How do you measure a third-party risk management program?

• Reduction in Third-Party Incidents: Track the number and severity of security incidents directly attributable to third parties. A downward trend indicates improved risk posture.
• Assessment Completion Rate: Monitor the percentage of critical third parties that have undergone initial and periodic risk assessments within defined timelines. High completion rates indicate operational efficiency.
• Remediation Timeliness: Measure the average time taken by third parties to remediate identified vulnerabilities or control gaps. Faster remediation reduces exposure windows.
• Vendor Risk Score Trends: Utilize security ratings services to track changes in third-party risk scores over time. Improving scores across the vendor portfolio signify enhanced security.
• Compliance Adherence: Track the percentage of third parties that meet contractual security requirements and regulatory obligations. This can be measured through audit findings and certification reviews.
• Cost of Risk Mitigation: Analyze the resources (time, money) invested in mitigating third-party risks versus the potential cost of incidents. This helps in optimizing resource allocation.
• Business Continuity Impact: Assess the impact of third-party disruptions on business operations. Reduced impact indicates improved resilience planning.
• Stakeholder Satisfaction: Gather feedback from internal stakeholders (e.g., business units, procurement) on the effectiveness and efficiency of the TPRM program.

Related Reading

• Technology Vendor Management Best Practices
• Zero Trust Architecture: From Framework to Enterprise Implementation
• Data Privacy & Security: A Framework for Tech Leaders

References

[1] IBM. (2023, July 24). IBM Report: Half of Breached Organizations Unwilling to Increase Security Spend Despite Soaring Breach Costs. IBM Newsroom, announcing the Cost of a Data Breach Report 2023. Retrieved from https://newsroom.ibm.com/2023-07-24-IBM-Report-Half-of-Breached-Organizations-Unwilling-to-Increase-Security-Spend-Despite-Soaring-Breach-Costs

[2] European Union. (2016). General Data Protection Regulation (GDPR), Article 83. Retrieved from https://gdpr-info.eu/art-83-gdpr/