10 Ways To Lock Down Third-Party Risk
Experts share ideas for closing potential security holes that leave organizations open to attack.
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltcab982b2b596b447/64f0d9dfe0ecf1646d65e5ab/Slide1-CoverArtThirdParty.jpg?width=700&auto=webp&quality=80&disable=upscale)
Ever since the Target breach in December 2013 and the resulting fallout, many companies have been paying closer attention to third-party security.
After all, it was one of its HVAC contractors that was the weak link in that incident, not Target itself.
And even with all the stories and conference seminars around third-party security, there’s evidence that there’s still much work ahead to plug the potential holes with third parties.
A Ponemon Institute study released earlier this year found that 67 percent of companies surveyed say they do not have or are unsure if their company has an inventory of third parties. Sixty-three percent say their organizations have no centralized control over third parties and 50 percent say third-party management is simply not a priority.
T.R. Kane, cybersecurity and privacy partner at PwC, says while it will take time for companies to put their third-party programs in place, there has been some progress during 2016.
“We’re seeing third party risk management show up as one of the top three board agenda items,” Kane says. “Companies are realizing that when a breach takes place it has a negative impact on the bottom line and share price so it makes more sense to focus on third-party management as opposed to the hundreds of millions it would cost to fix a problem.”
Here is a 10-point plan for managing third-party risk based on interviews with PwC’s Kane and input from James Christiansen, vice president for information risk management at Optiv and Fred Kneip, CEO of CyberGRX.
Establishing company-wide policies creates a solid foundation for any third-party risk management program. By letting the staff know that for any new contract the company plans to manage risk and that they will be expected to participate sets a tone that can lead to successful outcomes. Programs work best when everyone is clear that the real point of any new process or obligation is to prevent a breach by a third party.
Watch for how risk changes with a third party. The first contract may be low risk, but the second contract could be higher risk. Put processes in place so the company can demonstrate that the third-party risk program meets the business risk and regulatory needs. And provide ongoing risk-level reporting to the executive team that demonstrates the value of the third-party risk program.
Ever since the Target breach in December 2013 and the resulting fallout, many companies have been paying closer attention to third-party security.
After all, it was one of its HVAC contractors that was the weak link in that incident, not Target itself.
And even with all the stories and conference seminars around third-party security, there’s evidence that there’s still much work ahead to plug the potential holes with third parties.
A Ponemon Institute study released earlier this year found that 67 percent of companies surveyed say they do not have or are unsure if their company has an inventory of third parties. Sixty-three percent say their organizations have no centralized control over third parties and 50 percent say third-party management is simply not a priority.
T.R. Kane, cybersecurity and privacy partner at PwC, says while it will take time for companies to put their third-party programs in place, there has been some progress during 2016.
“We’re seeing third party risk management show up as one of the top three board agenda items,” Kane says. “Companies are realizing that when a breach takes place it has a negative impact on the bottom line and share price so it makes more sense to focus on third-party management as opposed to the hundreds of millions it would cost to fix a problem.”
Here is a 10-point plan for managing third-party risk based on interviews with PwC’s Kane and input from James Christiansen, vice president for information risk management at Optiv and Fred Kneip, CEO of CyberGRX.
About the Author(s)
You May Also Like
CISO Perspectives: How to make AI an Accelerator, Not a Blocker
August 20, 2024Securing Your Cloud Assets
August 27, 2024