There are lessons to be learned from the Colonial Pipeline ransomware attack. Panic is not one of them—it will yield no improvement nor progress for any situation. The event does strongly highlight how much more attention we need to pay to cyber risk now than past efforts demonstrate. The details of this ransomware incident are[…]
Some Risk Managers rely upon reported findings from internal risk assessments as the primary source of risk data in their Third Party Risk Management (TPRM) programs. Too often this approach generalizes over time from a primary to an exclusive source. That’s a missed opportunity to leverage value from other contributors to your operations, by incorporating[…]
This month, I’m going to depart a bit from the independent discussions of IT risk and cybersecurity to explore some of the specific ways this blog’s host, DoubleCheck Software, provides tools, resources, and value to companies working to manage their supply chain and partner risk—TPRM (Third Party Risk Management). The DoubleCheck GRC offers a platform[…]
If your company relies upon software from any third party, (and frankly today is there any organization that doesn’t) there is a third-party risk out there you are probably ignoring. It’s unlikely you wrote your own internet browser, or email system, word processor, or spreadsheet programs, or network management systems. It’s equally unlikely you are[…]
Third Party Risk Management (TPRM) is often viewed as a linear process. This is a misunderstanding of the actions that in total represent the processes involved. First, it’s a continuous system, renewing itself in different cycles and frequencies, depending upon the risk level of the third party’s service, and the practices of procurement; second, its[…]
Amazon Sidewalk is coming to your home, if your home contains smart devices relying on wi-fi and Bluetooth for network services. And if your company’s cyber risk footprint extends to a remote workforce located in homes and apartments with smart IoT devices like Ring and Echo, you have some work to do to assure you[…]
The last few weeks of each year often bring time for reflection, evaluation, and planning to set the start of each new calendar off on strong footings with clear direction. Taking time to evaluate your cyber risk program honestly, using evidence and achievement to support your review, represents a step toward greater program maturity and[…]
Smart technologies’ home presence grows with each passing day. The work-from-home (WFH) migrations for many workers seeking convenience while coping with “covid-19 encouraged isolation” have spurred this transformation to new levels of ready adoption. Smart thermostats, lights, home security cameras, front doorbells, automobile integration, automated window shades and curtains, TV’s and more, all managed through[…]
Over a number of past articles, we’ve explored the why, what, and how of Third Party Risk Management (TPRM). Looking back there’s much to review about the nature of the processes and methods that help companies understand the risks associated with partner, supplier, provider, and even inspector relationships. Some provide key services, some backup resources[…]
In prior articles we’ve explored why third-party risk management (TPRM) is an essential part of comprehensive risk management, and what steps need to be taken to assemble and execute an effective TPRM process. In this article, we’ll explore approaches to make those steps scalable and efficient without sacrificing quality, all while managing overall associated costs.[…]