The three Ps of third-party risk

Mark Sangster
Additional contact information
Mark Sangster: eSentire

Cyber Security: A Peer-Reviewed Journal, 2020, vol. 3, issue 4, 330-338

Abstract: As trusted partners, third-party vendors often become the overlooked or unwitting accomplice in criminal activities. As privacy laws and cyber security regulations continue to increase accountability around data confidentiality and protection, firms are struggling to shift from an in-house security paradigm to gain line of sight that extends to cover their vendors and the entire supply chain. Beyond the umbrella frameworks of NIST,1 ISO 27001 information and security management2 and ISO 27032 guidelines for cyber security,3 two smaller and —perhaps more palatable — guidelines offer simplified elements to frame supply chain risk management. The first, from the New York Department of Finance Cyber Rules NYCRR 500, section 11, provides actionable steps to access and mitigate vendor risk. The second resource comes from the National Cyber Security Centre in the UK, organised as 12 principles to grapple with supply chain risk, including defining risk, establishing mitigation controls, validating assurances and building in continuous improvement. This paper will explore the risks associated with third-party vendors, and how adversaries are leveraging supply chain vulnerabilities. It will also examine research that supports a three-step programme comprising policies (controls, due diligence tools and validation mechanisms), prevention (establishing risks and defining defensive requirements) and promises (contractual obligations, demarcated responsibilities, defined standards and warranties).

Keywords: policies; prevention; promises; risk assessment; data breach (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2020
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/5812/download/ (application/pdf)
https://hstalks.com/article/5812/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2020:v:3:i:4:p:330-338

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().