Managed Third Party Risk Management (MTPRM)

Some of the most damaging, high-profile cybersecurity incidents and data breaches in recent years were made possible because a critical supplier of the target organisation was first breached before the bad actors then moved laterally into the target organisation. This 'soft underbelly' in the supply chain has become a favoured attack vector of the world's most notorious hacker groups and lone wolf actors alike.

Understanding TPRM

Modern organisations, regardless of size, rely on complex information systems and networks to support their operations. These systems are composed of technology products and components supplied by various vendors, developers, and system integrators. Enterprises also use off-the-shelf products and services and develop internal software applications as part of a Software Development Life Cycle (SDLC).

‍

To achieve their strategic and operational goals, enterprises depend heavily on their supply chain. Identifying cybersecurity risks throughout this supply chain is complex, time-consuming, and requires specialised expertise. Many businesses lack visibility and understanding of how third-party technology is developed, integrated, and deployed. They also often do not fully comprehend how the services they acquire are delivered. Furthermore, enterprises with inadequate or absent Third-Party Risk Management (TPRM) processes face increased exposure to cybersecurity risks across their supply chain.

‍

The extent of cybersecurity risk exposure in the supply chain depends largely on how integrated the third-party products and services are with the organisation’s operations and the sensitivity of the data they access. The more integrated a third party is, and the more critical the data they handle, the greater the risk. MTPRM from The RANt Group takes the headache out of the costly, resource-intense process of ensuring your critical supply chain partners are constantly assessed, analysed, triaged and held to account regarding their cybersecurity posture.

Multilevel Risk Management

At Level 1 (Enterprise), the overall TPRM strategy, policy, and implementation plan sets the tone, governance structure, and boundaries for how TPRM is managed across the enterprise and guides TPRM activities performed at the outcomes and business process levels.

‍

At Level 2 (Outcome and Business Process), the mid-level TPRM strategies, policies, and implementation plans assume the context and direction set forth at the enterprise level and tailor it to the specific outcome and business process.

‍

At Level 3 (Operational), the TPRM plan provides the basis for determining whether an information system meets business, functional, and technical requirements and includes appropriately tailored controls. These plans are heavily influenced by the context and direction provided by Level.

‍