Third-party risk management: Strategy to mitigate ‘on-premise’ and ‘cloud’ cyber security risks

Abstract

This paper will attempt to exhaustively identify third-party partnership risks and describe requirements applicable to this relationship in the IT security business context. These entities have, either long-term or for an ad hoc period, occasional access to premises, infrastructures and/or data belonging to this organisation. These physical and logical accesses are a source of risk that all organisations should work to mitigate and avoid the materialisation of related threats and impacts that could jeopardise the achievement of their business objectives. Third-party risk management is the set of risk management practices and processes that adequately mitigate the risks inherent to the relationships between the company and its partners. These partners are identified by the designation of ‘third parties’. The mitigation of risks will be considered convenient if it ensures information assets security and compliance with legal and regulatory requirements and security requirements policies and guidelines. Mitigating these risks requires a different strategy depending on the type of business relationship and the nature of the service. The strategy applied to services delivered by a partner during an ‘on-site’ or ‘on-premise’ relationship has features that are not applicable to cloud-based services. The increasing attraction for cloud services — even for companies considered historically as refractory — requires particular attention to risks associated with this new reality of services. In North America (Canada and US) the use of cloud computing is becoming increasingly important in the public sector (such as government, hospitals) and the private sector operating in sensitive environments (such as ICS/SCADA networks). This paper, which is intended to be a practical tool for developing an IT risk management strategy with third parties, is applicable specifically in technology environments for both on-premises and cloud deployment. It applies to risks related to technological components in multi-client environments as well as dedicated service to specific customers.