Third-party risk management (TPRM) An ITC managed security service

65% 94% 83% Market conditions of breaches linked to third parties plan to spend more over next 12 months 83% of business leaders lack confidence Organisations are experiencing a growth in third-party associated cyber security risks …meaning a greater focus on third-party related governance and reporting …however, traditional TPRM programmes are resource intensive, complex and error prone.

Organisations need a way to translate and distil this cyber activity into meaningful information so they can identify key risks and create effective TPRM programmes.

Market conditions Cyber Security ratings provide a quantifiable correlation to third-party risk and data breaches: 5x more likely if your rating is below 400, than one above 700 3x more likely if 50% of your computers are running updated OS 2x Open Port risk vector grade is F But they require considerable effort to administer effectively, at a time when companies often have resource shortages and skills gaps.

Our TPRM solution A fully managed service that helps organisations measure, manage and reduce their exposure to third-party cyber risk. Providing continuous monitoring of third parties, using an industry recognised scoring system to identify where risk is highest. Giving clear guidance to enable productive interactions with third parties where risks exist, how they should be mitigated to ensure quick resolution for reduced cyber risk exposure.

Why you need it Whether managing a number of third-party vendors, potential new clients, new partner or acquisitions, continuous visibility of their security performance is critical. Poorly rated third parties carry a significantly higher risk (up to 5X) of cyber breach, understanding and mitigating this risk to your own business is a key business imperative.

The solution – three components ITC TPRM managed service 1. Setup and onboarding Monitoring and alerting Regular monthly reporting Expert cyber security knowledge to help you translate and distil all cyber activity and data into a tailored and actionable programme where the customer can identify, measure, and continuously monitor risk. Establish rules of engagement, standardised scoring, service processes (internal and external RACI) and governance policies around monitoring activities and thresholds.

The solution – three components ITC TPRM managed service 1. Setup and onboarding 2. Monitoring and alerting Regular monthly reporting Continuous monitoring of identified critical third parties, by a expert cyber analyst. Daily Event alerts indicating significant third-party profile and risk changes, including recommended remediation actions to enable easy collaboration with affected third party. Updated status for critical third-party remediation actions within the current month to enable vendor follow-up.

The solution – three components ITC TPRM managed service 1. Setup and onboarding 2. Monitoring and alerting 3. Regular monthly reporting Monthly performance reporting and trend analysis highlighting overall third-party and risk posture, industry trends, benchmarking, and threat activity. Deep-dive analysis on any flagged ‘at risk’ third-parties. Monthly de-brief call with a cyber analyst. Annual programme review and refinement workshop.

The solution – key features ITC TPRM managed service Setup and onboarding Initial TP Risk Assessment Report – overview of identified priority risk vendor rating performance, review of current framework, and guidance on how rating and alert data could integrate into these processes and policies Onboarding Workshop informed by report to identify and agree vendor categorisation / risk tolerance, initial remediation guidance, definition of service processes (RACI), and set alerting thresholds and preferences Monitoring and alerting Continuous monitoring Daily alerts based on: Rating, and risk vectors changes Infections, vulnerabilities and breaches Full details and remediation guidance Alert Status Tracker: updated status to track evidence of remediation Triaged and sent via email in password protected .pdf On-demand cyber expert support 2hours month Annual programme review and refinement workshop Regular monthly reporting Vendor Performance overview of monitored vendors, by score rating and risk changes Trend analysis / vendor deep-dive Significant rating / grades drops Performance vs benchmarks Summary of infections, vulnerabilities, breaches, by affected vendors Remediation and alerts status summary Benchmark insights (ratings vs industry) Emailed password protected .pdf De-brief call – Q&A, threshold refinement

Benefits of our solution Expert advice for best practice set up, monitoring, and management of third-party risk Alerts backed by professional analysis for improved risk insight Effective remediation guidance to reduce the risk of breaches and facilitate easy vendor engagement Tracking and trend information to monitor individual companies Peer-based benchmarking