The three Ps of third-party risk

Abstract

As trusted partners, third-party vendors often become the overlooked or unwitting accomplice in criminal activities. As privacy laws and cyber security regulations continue to increase accountability around data confidentiality and protection, firms are struggling to shift from an in-house security paradigm to gain line of sight that extends to cover their vendors and the entire supply chain. Beyond the umbrella frameworks of NIST,1 ISO 27001 information and security management2 and ISO 27032 guidelines for cyber security,3 two smaller and —perhaps more palatable — guidelines offer simplified elements to frame supply chain risk management. The first, from the New York Department of Finance Cyber Rules NYCRR 500, section 11, provides actionable steps to access and mitigate vendor risk. The second resource comes from the National Cyber Security Centre in the UK, organised as 12 principles to grapple with supply chain risk, including defining risk, establishing mitigation controls, validating assurances and building in continuous improvement. This paper will explore the risks associated with third-party vendors, and how adversaries are leveraging supply chain vulnerabilities. It will also examine research that supports a three-step programme comprising policies (controls, due diligence tools and validation mechanisms), prevention (establishing risks and defining defensive requirements) and promises (contractual obligations, demarcated responsibilities, defined standards and warranties).