View TPRM Risk Through Four Lenses

This blog was originally published by Coalfire here.

Written by Jon Knohl, Coalfire.

Organizations can more effectively evaluate their risk profile by measuring confidentiality, integrity, and availability as they each relate to the enterprise-wide domains of financial, regulatory, reputational, and operational risks.

Key takeaways:

• Proactively addressing risk is more cost effective than handling a breach that has already occurred
• It’s critical to make sure you understand which compliance frameworks impact your industry, and know whether your program meets the requirements
• Include your Procurement, Information Technology, and Public Relations departments in your breach planning activities such as scenario building

In recent years, as attackers seek to gain entry and disrupt business through vendors, Third Party Risk Management (TPRM) has proven to be a top priority item for every organization. As organizations mitigate the risks associated with a third party-related attack, leaders should continue to address the risk that third parties present for confidentiality, integrity, and availability. More specifically, organizations should further evaluate their risk profile by measuring them as they each relate to the enterprise-wide domains of financial, regulatory, reputational, and operational risks. In the world of information technology compliance, these four specific domains represent primary risk factors and cover a holistic view of organizations on a day-to-day level.

Financial

Per IBM’s "Cost of a Data Breach Report" published in July 2021, the average cost of data breach rose from $3.86m in 2020 to $4.24m in 2021. The potential financial impact to your organization could be rather detrimental. It’s usually less expensive to proactively ensure that critical functions are meeting the controls necessary to protect your data in the event of breach, rather than shouldering the financial outcomes of responding to a breach. A loss of availability to customers can also lead to violation of contracts which also carries a hefty bill to resolve.

Regulatory

Dependent on your industry, there are a variety of state and federal regulations (i.e. GDPR, CCPA, Sarbanes Oxley, HIPPA, and GLBA) that are aimed at protecting sensitive data. It is critical to ensure your organization is familiar with and adhering to such regulatory measures because failure to meet regulations leaves your organization vulnerable to steep fines and penalties.

Reputational

The negative impacts of a data breach to client data confidentiality includes loss of both customer confidence and competitive advantage. What’s more, your organization can easily inherit reputational impact from a supplier breach. While mitigating reputational risk is challenging, it is essential to prepare for such impacts by making your organization's public relations function aware of your third-party relationships and allowing the function to begin brainstorming about how to mitigate such risks. This typically involves a collaborative discussion between your procurement, information technology, and public relations departments to discuss applicable scenarios that might impact your organization and develop internal and external response options.

Operational

Businesses leverage third parties to support business operations and fill the void in areas your organization is unable to meet. In the event of a loss of availability, your organization's business operations could face the consequences as well. One example is related to payroll as a majority of organizations outsource their payroll function to third party providers. A hit to your organization's ability to process payroll as well as other financial related functions would hinder your ability to do business.

Conclusion

While third party risk can be measured in a variety of ways, the recommendation is to ensure your organization is first capturing risks as they relate to financial, regulatory, reputational, and operational impacts to the business in order to develop a comprehensive view of your company’s third party threat landscape.