It helps companies understand what potential risks they might take on by engaging with certain partnerships. Ultimately, TPRM is an umbrella term encompassing the management of all kinds of risk posed by third parties. These types of risk include:
Working with vendors, partners, and suppliers naturally introduces some risk to your organization. With more businesses connected than ever, effectively measuring third-party risk is essential to keeping tabs on your own cyber hygiene.
However, the level of risk your company faces varies depending on a third party’s unique security profile and your risk appetite. Tolerable risk varies from organization to organization, meaning what might be unacceptable to one business could be acceptable to another. Those contextual factors mean there is no one-size-fits-all approach to TPRM.
Therefore, an effective TPRM strategy analyzes vendors’ risk profiles based on an organization’s individual risk appetite, values, and goals.
Let’s take a look at a few examples of how organizations apply TPRM in real life:
Worries Over Ransomware
A security team might be worried about susceptibility to ransomware that takes advantage of a specific critical vulnerability exploit (CVE). To assess the risk a vendor poses, that team would deploy third-party risk management strategies or tools to identify whether the vendor had that CVE and whether or not it had been remediated.
This process helps security teams gain a greater understanding of the potential vendor’s risk profile — and therefore make better decisions on whether or not that risk is worth the benefits of working with that vendor.
Concerns About Concentration Risk
An organization might be concerned about whether it faces excess concentration risk — or the risk that accumulates when a considerable amount of value or assets are concentrated with a single vendor. When an organization experiences a breach through a vendor it heavily relies on, it magnifies the effect of the cyber incident, such as downtime or loss of business services.
As such, an organization would use third-party risk management strategies to conduct an audit of its vendors to identify the concentration risk of each, determine which vendors have unacceptably high concentration risk, and identify where diversification of vendors is necessary to mitigate intolerable risk.
The most imminent threat in today’s threat landscape is connected risk — or risk from working with third-party partners and vendors. In fact, 98% of companies that conduct business with third parties suffer from breaches.
How can modern third-party risk management programs mitigate the blow of third-party risk? By granting security teams access to contextualized insights to ramp up defense against bad actors — and ultimately, save organizations time, resources, and cold hard cash.
Here are a few popular methods, how they work, and where they fall short.
To help combat mounting threats from unmanaged third-party risk, organizations often deploy security questionnaires.
A questionnaire is a list of security-related inquiries meant to provide the issuing company with insight into a vendor’s cyber hygiene. These questionnaires help organizations decide whether or not to do business with the vendor in question. Because questionnaires are produced by individual organizations, the questions included may vary from company to company.
While still widely used, questionnaires have faced criticism in recent years that they’ve become outdated and unwieldy in today’s fast-moving threat landscape. Some of these criticisms claim that questionnaires are:
Security rating services are private entities that devise processes for analyzing an organization’s cyber hygiene. These services then “rate” a company’s cyber health, typically by granting an A to F letter grade.
Today, ratings are closer to credit scores than accurate representations of an organization’s risk profile. Organizations need decent security ratings in order to safeguard their reputation, and more importantly, qualify for cyber insurance. However, these ratings in and of themselves do not necessarily show an objective picture of an organization’s cyber risk profile.
All organizations are susceptible to breaches, even those with high ratings. Some famous examples include:
Curious about their grades? Schedule a demo call.
Ultimately, this lack of context leads to a letter grade that, while seemingly objective on the surface, ends up being a subjective assessment of how susceptible a vendor might be to breaches, leaks, and attacks.
Here’s why traditional methods of measuring third-party risk aren’t cutting it:
Qualitative questionnaires provide an incomplete picture of risk. They cannot obtain an objective view of a vendor’s cyber hygiene because they rely too strictly on good faith and fail to contextualize the insights they collect.
Rating systems are opaque and also lack appropriate contextualization from vendor to vendor. Instead, they reduce risk to static letter grades that make it difficult to facilitate effective decision-making.
Why haven’t more companies moved on to more advanced third-party risk management? Roadblocks in the form of cost, resource strain, and budget prioritization present challenges in modernization — but the real source behind TPRM stagnation is human nature.
People are creatures of habit, and old habits die hard. Organizations have developed approaches to TPRM they’re already accustomed to, making modernization difficult to achieve.
Here’s the truth about ratings and questionnaires: they don’t work alone.
Although letter grades can provide some idea of a vendor’s cyber hygiene, they fail to paint a full picture of risk because they lack contextualized insights. Without contextualized insights, organizations can only see a surface-level picture of risk. That qualitative risk isn’t enough for organizations to make critical decisions.
An effective TPRM program needs to put risk in quantifiable terms. In other words, it needs to assign risk a dollar value.
Assigning risk a concrete numerical (and financial) value helps executives understand supply chain risk — and therefore, drive practical decisions and policies. Giving risk a dollar value also helps executives concretely see where TPRM strategies are lacking — and what they might pay for it.
Looking to expand your knowledge on building out the right TPRM program but unsure where to start? Check out our starter pack of TPRM essentials: