In the modern economy, almost every business is a tech business, with digitization, automation, and data solutions embedded into multiple operations. But with these advancements come risks. One of the most critical risks is that responsibility for technology often does not sit with companies themselves but instead with an array of third-party suppliers, service providers, and subcontractors. By outsourcing IT services, companies can unlock efficiencies and innovation. The downside is that they can also struggle to ensure that their businesses remain secure and resilient.

Modern technology supply chains are not much like chains at all. In fact, they are more like three-dimensional spiderwebs, each strand of which is connected to and dependent on others, and some of which are far removed from the company itself. As such, technology risk management is increasingly concerned not only with immediate supplier relationships but also with distant and sometimes ambiguous third parties, or nth parties, which often sit several layers away from the company’s direct line of sight.

Third- and nth-party supplier cyberincidents are a significant source of risk, in some cases leading to the loss of data for hundreds of millions of people. Indeed, over the past two years, nearly one-third of cyber breaches has been associated with technology supply chains, and multiple incidents have highlighted the cascading effects that a single compromised supplier can have on organizations and sectors. Moreover, despite companies sometimes spending millions on controls, supply chain oversight is often surprisingly basic—comprising unvalidated responses in risk questionnaires or simple clauses contained in contracts. Alternatively, companies spend so much time focusing on supplier cyber risks that they drag their feet and fail to implement a useful, high ROI solution in a timely fashion.

As the number of ransomware incidents, data breaches, and supply chain attacks continues to rise (up 83 percent, 135 percent, and 236 percent, respectively, over the past two years), companies urgently need to ramp up their capabilities. To some extent, this is already mandated by regulation. The European Union’s Digital Operational Resilience Act (DORA), the United Kingdom’s Financial Conduct Authority (FCA) and Prudential Regulation Authority (PRA) operational resilience rules, and Australia’s APRA CPS 230 are among initiatives that lay out strict standards for IT risk management. These vary somewhat in their detail, but one underlying principle holds true: Companies have a duty to ensure that their approaches to supplier risk management reflect both their unique risk profiles and the criticality of the business processes in question.

Traditional third-party risk management (TPRM) frameworks often emphasize the confidentiality and integrity aspects of the CIA (confidentially, integrity, and availability) triad. But the availability—and, more specifically, the resilience of business-critical systems (the ability to withstand an adverse event without interruption)—is equally as important. Indeed, focusing on business-critical nth-party relationships, rather than getting bogged down in hypercomplexity, is an excellent way to get a grip on supply chain risks. At a time of rising cyberthreats, companies that can put this distinction into practice achieve the double win of protecting their vital operations and building competitive advantage.

Read more →

Go to website →