A Practical Guide to Third-Party Risk Assessment

As organizations increasingly outsource critical services and embrace migration to the cloud, it’s becoming more crucial that they verify that their third party is using proper access controls – especially when they share sensitive data with that third party. Many organizations unknowingly grant their third parties privileged access, which could be why 70% report that a data breach originated from granting their third parties too much access. Instead of monitoring third-party security controls themselves, they rely on the terms of the contract or the reputation of the third party. 

One method organizations should be using to internally assess their third party’s cybersecurity practices overall, including access controls, is with a third-party risk assessment.

Understanding Third Party Risk Assessment

While the term “third party” is often associated with the term vendor, they are not the same. A vendor sells goods or services directly to your organization while a third party is an external organization that supports your organization’s strategy, services or products. A third party might include a partner, consultant or outsourced service provider, such as an IT service that manages your cloud infrastructure. 

As a result, a third party risk assessment is more holistic in nature and covers a wider variety of risks. A vendor risk assessment is more limited to whether or not the supplier fulfills the obligations of their contract and delivers quality service or goods.

Types of Third Party Risks

Third-party risk assessments are an essential part of identifying and evaluating inherent risk. When properly identified and mitigated, they can minimize the number of cyberattacks and operational disruptions to your company while building greater trust in your third parties. 

Third-party risks include: 

• Operational risks. Disruptions in your service due to data breaches, natural disasters, outages, supply chain disruptions, overreliance on one vendor, systems failures can all lead to significant financial loss and reputational risk. 
• Financial risks. Data breaches, DDoS and ransomware attacks and other security incidents can result in hefty penalties, and the revenue lost as a result of any operational disruption during these attacks. 
• Strategic risks. Mergers, suppliers that fall on hard times, over reliance on certain suppliers, and business goals that are misaligned can all create strategic risks for your organization. 
• Compliance risks.Third parties must adhere to regulations such as DORA, NYDFS, and the NIS2 Directive, which deal specifically with outsourcing to third parties. Third parties must also adhere to regulations for their specific industry  (e.g., EBA and PCI DSS), geographic location, and type of customer as well  (e.g. GDPA, CCPA, EBA).
• Reputational risks. Cyberattacks, operational failures, company scandals, and issues with product quality of suppliers can impact your organization’s reputation.
• Cybersecurity risks. Ransomware, DDoS attacks, data breaches and other security incidents can impact your company’s reputation, operations and cost your company in time, resources and incur debt for failure to comply with regulations.

Importance of Third Party Risk Assessment

As third parties and internet infrastructure become increasingly interconnected, it is even more crucial for organizations to conduct frequent third-party risk assessments and have a recovery strategy and contingency plan in place.

The most recent example of this was the Crowdstrike attack that grounded flights, disrupted 911 centers, broadcasts and even the London Stock Exchange. The cause was a defective software update from Crowdstrike that impacted Microsoft Windows operating systems globally. Another example from the UK recently determined that a threat actor exposed the names of names, bank account details, and other information for current, former, and reserve members of the British Army, Naval Service, and Royal Air Force through a third-party contractor. Evidence showed that the payroll service was not doing enough to protect its data from malicious threat actors. 

This was the second incident in a year that exposed sensitive information from the UK military.

Regulatory Compliance for Third Party Risk Assessment

As organizations have increased their reliance on third parties, regulatory bodies have stepped up to include regulations that specifically deal with risks from third parties. These regulations include those that target financial institutions, such as DORA and NFDFS as well as those that target the health industry, such as HIPAA and HITRUST. They even extend across geographic regions, such as the NIS2 Directive, a EU regulation that includes a broader scope of organizations and industries than DORA.

In addition, these regulatory bodies have also started to develop AI regulations. The AI Act bans  the use of certain applications in the EU such as facial in general and emotion recognition at work or at school. It also holds companies responsible for any damage incurred by the new technology. The Executive Order on AI aims to protect U.S. citizens against the risks of AI by requiring greater transparency on how the models work and establishing a new set of standards.

A 5-Step Guide to Completing a Third Party Risk Assessment

With the challenges of increased regulations, complexity of the supply chain, and lack of internal resources to verify access controls, third-party risk assessments must be a simple and standardized method for organizations to manage third-party risk. 

Here are five steps for completing a third-party risk assessment that any organization can use and adapt as needed:

1) Identify Third Party Relationships and Services

Due to the complexity and dynamic nature of today’s supply chain, nearly 48% of organizations don’t have a comprehensive inventory of third parties they use. This is likely one of the contributing factors for 98% of organizations reporting doing business with a party that has suffered a data breach.

2) Risk Evaluation: Using Questionnaires and Assessment Tools

Organizations have a number of tools in their arsenal to assess third-party risk, including cybersecurity questionnaires, vendor risk assessment questionnaires and risk scoring. These questionnaires should be customized according to the criticality of each business relationship to understand their approach to data protection, adherence to regulation, and how their internal policies align with their risk management approach. In addition, organizations should identify if the third party uses a specific risk management framework.

3) Third Party Risk Assessment: Due Diligence

Due diligence should evaluate your third party’s approach to issues such as cybersecurity, operational controls, disaster recovery and adherence to relevant compliance and regulations. It may include reviewing compliance certificates, evaluating the vendor’s security controls, and audit reports along with other relevant documents. Proper due diligence helps you to proactively assess the risk posed to your organization and either decide not to enter the business relationship or take steps to mitigate against the risk.

4) Risk Mitigation Plans

Risk mitigation involves evaluating the current security controls your vendor uses to identify and issues that might need to be addressed. These plans should be implemented according to the criticality of each vendor, with the most critical issues being addressed first. Mitigation strategies might include developing better security controls, adjusting the third party’s internal policies to align with your organization’s risk management, and including a penalty for non-compliance in third-party contracts.

5) Third Party Risk Assessment: Continuous Monitoring

Due to the dynamic nature of the cybersecurity landscape, IT infrastructure and regulatory compliance, risks evolve continuously, and changes to your IT infrastructure are frequent. As a result, you’ll need to implement third-party risk assessments continuously to ensure they are up-to-date and effective at mitigating third-party risk. In addition, continuous monitoring helps to identify issues early and proactively work to mitigate them.

Best Practices for Third Party Risk Assessments

Integrating third-party risk management into your organization’s overall risk strategy requires a structured approach. This includes defining its scope and objective and identifying risk criteria and thresholds for different risk categories (e.g., operational, financial, regulatory, reputational, etc). The third-party risk assessment should also be implemented via a standardized process that includes due diligence, risk scoring and risk mitigation strategies. Each third party should be evaluated using the same criteria and tools to ensure consistency.

Collaboration and Communication with Stakeholders

Third-party risk assessments demand collaboration with both internal and external stakeholders. Identifying internal stakeholders such as procurement, legal, compliance, HR, marketing and sales and communicating with them can help you align the security goals of the third-party risk assessment with overall business objectives. In addition, each group of stakeholders may have different priorities to address in the assessment. 

Third-party vendors should also understand the goal of the assessment and any deadlines involved. Proper communication is crucial for improving the risk management process and establishing effective mitigation strategies.

Third Party Risk Assessment Technology and Tools

Different solutions exist today for third-party risk assessments, including automation and AI. A lot of data from third parties can be collected and verified automatically through sources such as compliance reports, cybersecurity assessments and financial reports. Risk scores can then be automatically assigned based on the data received. 
In addition, artificial intelligence (AI) can help identify unusual behavior that points to new or evolving risk, and even predict future behavior based on past security incidents and current cybersecurity practices. With more advanced third party cyber risk management solutions such as Panorays, it can also accelerate the process of completing and evaluating cybersecurity questionnaires through AI-generated answers based on past similar questionnaires and AI-powered validation of answers by cross-referencing them with vendor documents. It can also use AI to map the digital supply chain and identify the KEVs, CEVs and vulnerabilities relevant to each party so that organizations can prioritize and remediate against risk more efficiently.

Third Party Risk Assessment is a Critical Part of TPRM

A third-party risk assessment is a vital component of any organization’s third-party risk management. By standardizing your assessment, collaborating with both external and internal stakeholders, and including the most recent TPRM tools and technology, you’ll be able to align goals between different parts of your organization while at the same time effectively minimizing risk and building supply chain resilience. 
Want to learn more about how you can manage third party risk across your extended attack surface? Get a demo of our third party risk management platform today.

Third Party Risk Assessment FAQs