CISOs Guide 3P Security Management

In this guide, we provide the guidance you need to make your organization’s third-party security program effective and scalable.
In particular, we cover how to:

• Implement compensating internal controls when your suppliers don’t have or won’t reveal their own
• Collaborate with suppliers to ensure success in the remediation process
• Create KPIs to help manage, improve the process and demonstrate achievements

Because you share data with third parties, you must stay informed about their security as much as your own. Managing the security of your third parties is even more important because of the following reasons:

1. Increase in cloud apps. According to a McAfee report, the average organization increased its usage of cloud services by 15% from last year. Moreover, the amount of sensitive data shared on the cloud increases 53% year over year. It’s expected that within a decade, 90% of IT dollars will be spent outside of the IT organization.
2. Remote working. Many companies that have shifted to working from home face increased cybersecurity challenges, including technology and human risks. The same can be said for their
   third parties.
3. Third-party data breaches. According to a Ponemon report, 59% of organizations experienced a data breach caused by their third parties. The consequences of such breaches can be disastrous and can include lost consumer confidence and loyalty, as well as costly penalties that could even lead to bankruptcy.
4. New regulations. Data privacy regulations such as GDPR, CCPA and the NY SHIELD Act require companies to ensure that customer data remains private and secure. A breach through a third party could result in significant financial penalties for the organization to which it is connected.

For all of these reasons, having a comprehensive third-party security process is crucial.