How to Choose the Right Third-Party Risk Management Framework

The recent Snowflake data breach is considered one of the largest and most costly breaches to date.

Snowflake’s cloud storage service was systematically attacked, putting customer data at risk and affecting vendors and partners alike. 

We’re still learning about the affected companies, though the list now includes over 2 million Advanced Auto Parts customers (in addition to the already-known Santander and TicketMaster customers). 

This incident shows the urgent need for businesses to reassess their third-party risk management (TPRM) approach.

Given growing third-party risks, there’s never been a better time for security providers and in-house teams to create effective, customized TPRM programs to suit their needs.

‍

What is a Third-Party Risk Management Framework?

A third-party risk management framework is a structured approach to identifying, assessing, and mitigating risks associated with third-party vendors. 

This framework enables you to address possible security risks prior to working with a third-party vendor. Your TPRM provides guidance for setting up protocols that mitigate vendor risks through policies, procedures, and contract expectations.

But the trouble with third-party risk management is that there are no frameworks ready out of the box for creating a suitable, comprehensive TPRM program.

Yes, there are frameworks you can reference, like NIST or ISO 27001, but they’re insufficient in that they fail to address (and provide protocols for) the finer points of third-party risks.

‍

Why Do You Need a Third-Party Risk Management Framework?

Organizations integrate with vendors to optimize efficiency, improve communication, and share information. This interconnectedness has tremendous benefits, but it isn’t without risks. Sharing information with a third party that hasn’t been sufficiently vetted could lead to that information being compromised. 

That kind of compromise could be catastrophic to your reputation — not to mention the cost in terms of time, containment, mitigation, legal fees, and other impacts.

‍

Who Should Understand Third-Party Risk Management Frameworks?

Third-party risk management is relevant to MSSPs, security-focused MSPs, and internal IT teams, as well as: 

• Security-Focused IT Professionals - Understanding TPRM frameworks can help IT professionals address IT-related vendor risks.
• GRC Analysts - For those trying to achieve compliance (whether for your organization or your customers), following the right TPRM framework is crucial for identifying and mitigating risks in support of compliance efforts.
• vCISOs - Virtual CISOs are likely already familiar with building cybersecurity programs. The process of building out a framework specifically for vendor risk management will feel familiar, but there are a few key differentiators from your standard frameworks. 
• Compliance Managers - Compliance managers will systematically monitor and mitigate risks to achieve and maintain vendor compliance in order and keep their own organizations compliant.

‍

Choosing the Right TPRM Framework

When choosing a TPRM framework, you should consider existing risk management practices and how you can incorporate the framework without making overly drastic changes.

Smooth integration is necessary for TPRM framework success, so here are a few things to consider when choosing the right framework. You’ll assess:

• How your framework will address data gathering (ideally, through automation).
• How to benchmark progress and performance.
• How the framework will be updated (for changing threats and regulations).
• How risks are defined, addressed, and categorized (for prioritization).
• How the framework will help you or your clients comply with regulatory requirements.

As a reminder, TPRM frameworks must, by necessity, be tailored to your organization. Now, we did mention that there are frameworks you can reference, but they don’t provide comprehensive TPRM guidance. Keep this in mind as we discuss those frameworks next.

‍

Popular TPRM Frameworks

These are the three most popular TPRM frameworks:

1. NIST (National Institute of Standards and Technology): NIST is a comprehensive framework for helping businesses mitigate cybersecurity risk. It uses rigid guidelines for identifying, understanding, and addressing cyber risks but doesn’t comprehensively address TPRM.
2. ISO 27001: Another solid information security management framework, ISO 27001 is an international standard also known for its rigidity. While it’s ideal for organizations looking to protect sensitive company information and improve their information security management system (ISMS), its vendor risk management component isn’t comprehensive. Especially since it focuses mostly on information security. 
3. COBIT (Control Objectives for Information and Related Technologies): This IT-focused framework is another ideal reference point for building your TPRM. However, it’s built around IT governance and management, so several third-party risks (like financial or supply chain risks) fall outside its scope.

‍

Components of a TPRM Framework

Across the board, the agreed-upon crucial components of a good TPRM framework are:

1. Risk Identification
2. Risk Assessment
3. Risk Monitoring
4. Risk Mitigation
5. Continuous Monitoring

Each of these components works together to create a comprehensive third-party risk management framework. 

‍

Risk Identification

Step one is identifying and documenting potential risks associated with working with a third-party vendor. This will differ from vendor to vendor, as cloud-based CRMs have risks different from those of an office supply vendor, for example. It’s important to spot any potential risks that could affect operations.

‍

Risk Assessment

Once you’ve identified all potential risks, you can move to assessment, where you can evaluate each risk’s possible business impact. You’ll also consider the likelihood of an incident to inform and prioritize the next steps in the process. 

‍

Risk Monitoring

Now it’s time to monitor the above risks. The best way to do this is through specialized software solutions that allow you to monitor risks in real time. This is a continuous process that involves tracking and analyzing risks over time, especially in relation to the changing threat landscape, emerging risks, and any steps that need to be taken to proactively mitigate any third-party vulnerabilities.

‍

Risk Mitigation

The policies and procedures you put in place, as well as your controls and contingency plans, will minimize the impact of risks. Risk mitigation strategies might include contractual agreements and regular audits with third-party vendors.

‍

Continuous Monitoring

This process must be maintained continuously, especially since a key component is monitoring potential and emerging risks. Following through on all the other steps but failing on this one means the overall program fails.

‍

Implementing a TPRM Framework Step-by-Step 

Implementing your TPRM may seem overwhelming at first. Don’t worry — If you’re already familiar with security protocols or GRC frameworks, you know how most of this goes. However, let’s go over each step anyway, from the top:

‍

1. Start By Understanding Your Unique Risks

Consider your industry, objectives, and risk tolerance. What kind of risks come with your business and from your vendor relationships?

The key to success here is to leave no stone unturned. Ideally, you don’t move on from this step until every single possible risk has been considered and documented. The point of this is to keep things documented for accountability, to track progress, and to ensure your program is actually working. If you’re satisfied with your comprehensive, well-documented risk profile, you can move on to the next step, which is understanding your vendor’s risk profiles.

‍

2. Categorize Your Third-Party Relationships 

Create buckets by which you can categorize your vendors. This will differ from business to business, but generally, you wouldn’t group cloud-based CRM providers with office supply companies. They have vastly different risk profiles. 

Your CRM provider has access to customer lists, so you have to understand the risks that come with that. Likewise, the CRM provider has a different risk profile from the office cleaning service that needs physical access codes to get into the office. 

You should also identify previous vendors, even if you haven’t worked with them in years. Just because they no longer work directly with them doesn’t mean they don’t pose a potential security risk now (or down the line). 

For each vendor (past or present), clearly outline their relationship with your organization and any potential systems they’ve used or have had access to.

‍

3. Conduct a Risk Assessment

The next step is to conduct a risk assessment for every single vendor you’ve categorized. Your goal here is to understand, in the most comprehensive way possible, their risk profiles, especially as they intersect with your organization. 

Ask yourself what possible ways the relationship can lead to an incident such as a data breach, operational disruptions, compliance failures, or reputational damage. If you want to use templates by which to run your risk assessments, you can refer to frameworks like SWOT analysis (Strengths, Weaknesses, Opportunities, Threats).

‍

4. Define Risk Mitigation Strategies

The next step is to create ways to mitigate every risk in your vendor risk profile. The reason we’re referring to this as “risk mitigation strategies” is that the process requires strategic thinking. Part of that is setting up a control for each risk — but not without having an overarching understanding of your business goals. 

For example, every control in ISO 27001 (which we referred to earlier) must be tied to a business objective. So, as you create strategies to mitigate every possible risk, keep your goals in mind, and remember that these will differ from vendor to vendor. You can leverage strategies such as contractual obligations, controls, regular audits, and more.

‍

5. Implementing Controls and Monitoring Mechanisms

Once your mitigation strategies are in place, it’s time to implement controls and monitoring. Again, every risk needs a control, and every control should be tied to a specific business goal. Even if you’re implementing a host of controls for each vendor. 

Remember, all it takes is one bad vendor to cause catastrophic damage to an organization.

So, take the time to establish clear protocols and procedures, and feel free to leverage automated tools to make this process as straightforward as possible. With the right automated tools, you can quickly create and send automated, personalized questionnaires, store, and access answers in a centralized database, and monitor vendor risks in real time. 

‍

6. Reporting and Accountability

Every team member in every department needs to understand their role in keeping your organization secure. You can achieve this through training and by having everybody read (and sign off on) security policy updates. Part of the learning and improvement process is being open to feedback and having a (usually anonymous) reporting system. In other words, it should be easy for anybody to report a vulnerability for the sake of the company’s overall security. 

‍

7. Improve Your Framework

Over time, as you learn what makes your framework effective and where it’s lacking, you can continually make program improvements. This is especially important with regard to training and meetings and keeping feedback open. 

This step never actually ends, as your program should be continually updated and improved to meet the challenges that arise over time.

‍

The Benefits of a TPRM Framework

Let’s say you’ve successfully implemented a TPRM framework into your compliance program. Great! Here are some of the benefits you might enjoy:

• Improved stakeholder trust - Build trust with key investors and business partners through having a proactive, established approach to TPRM.
• Enhanced compliance - Get and stay compliant with regulatory standards and avoid non-compliance.
• A smoother future audit - In the event of a future security audit, you’ll already have policies, procedures, and information in place for a smoother audit process.
• Heightened risk visibility - Thanks to your TPRM, you can better identify third-party risks (in real time if you have automated solutions).
• Greater operational efficiency - Improve efficiency while mitigating risks.
• Enhanced decision-making - Gain insights for better decision-making.

‍

Leveraging Automation Tools

If your third-party risk management processes are riddled with manual spreadsheets and workflows, you might want to consider tools for streamlining and automating vendor risk management.

If you need to properly vet vendors or better manage vendor risk, software solutions can help streamline the process. Some vendor risk solutions can also help you prepare for and run security audits, build vendor questionnaires, instantly flag risks, and store every important template, questionnaire, and contract in a centralized system.

‍

Conclusion

Follow this step-by-step process and you’ll be prepared for just about any vendor-related risk issue. Remember, this is important to maintain the integrity of your security posture, as breaches can happen with any vendor in your network. 

While the process may be complicated, if you stick to the plan and focus on organizational goals, you can dramatically reduce the possibility of an incident.

‍