The structure of most organizations’ information processing involves large numbers of third party organizations that have access to organizations’ most critical and sensitive data. Even modest sized organizations have hundreds of third parties. Without mature structure for effective management of third parties, organizations fail to uncover and manage risks they would find unacceptable had they been known. This session discusses program structure for managing third party risk, including the concept of risk tiering, based on various criteria, with corresponding levels and types of due diligence activities, including short and long questionnaires, requests for evidence, on-site visits, assessments by expert security firms, and intrusive monitoring.

 

Learn how to build a risk based third party risk program for your organization, including risk tiering, up front and ongoing due diligence, and management reporting.