- Welcome to lesson 25,
explain the process associated
with third party risk assessment and management.
Now, in this lesson, 25.1
we're gonna focus
in on third party risk management.
Third party risk management
is a composite activities
that we use to research
and source our third parties,
conduct due diligence investigations,
negotiate our contracts, manage relationships,
evaluate performance,
and make our payments.
Now, third parties include vendors, contractors,
business partners, and service providers.
Our fourth parties are sub-service organizations
of third parties.
Now, I know you know that
because we've already talked about it.
Third party oversight
is the implementation of strategies
to manage uncertainty, identify vulnerabilities
and ensure compliance and continuity.
There's a whole range
of third party oversight activities
including conducting due diligence
investigations related to the service provider selection
and subsequent business activities,
requiring NDAs or non-disclosure agreements,
codifying our service relationships,
coordinating our incident response protocols
and contractual notification
and then monitoring the service provider
through appropriate audits and testing.
So let's talk about due diligence, right?
Due diligence is the act of investigating, right,
a third party before we're going
to enter into a business contract
and then during the subsequent business activities.
And certainly we're gonna do it again
before we renew a contract.
So what are some of the things that we'd look
at from an information security perspective
in terms of due diligence?
Controls, compliance,
vulnerability management, end of life
end of support assessment, the right
to audit, incident management,
and business continuity.
So we're looking at the vendor's ability
to implement required security
and privacy controls, but not just for them.
We also wanna be inclusive of fourth parties.
These are the controls we're requiring.
Compliance is the third party's understanding
of and their ability to comply
with regulatory requirements.
Vulnerability management is assuring
that they will disclose in their vulnerabilities
and understanding what is the frequency
of their patch releases.
For end of life and end of support,
we wanna make sure that we understand
their end of life
and end of support cycle,
as well as the notification
and how they offer their support.
For assessment, it's always great to have proof
of independent security testing
and many third parties will say, "Oh
I'll show you our own testing."
It's like, no, no, no.
I want independent testing.
The right to audit is an agreement to allow
either independent audits, so we bring somebody
in to audit a third party
or to provide equivalent audit material.
And we'll be talking about that when we talk
about SSAE18 reports.
Incident management is their detection
and response capabilities,
as well as understanding
their security breach protocols.
And then business continuity
will be their ability
to continue to provide service
and to operate in adverse conditions.
So these are all
of the things that we wanna
look at for the third party.
how they do it, what they can do.
Let's dig a little deeper
into right to audit.
A right to audit contract
provision clause grants the contract holder
the right to conduct or oversee an audit
of the service provider's facilities and practices.
Now, this provision is often limited to annually,
unless there's been a security
breach or a complaint related
to the service provider's privacy
or security practices.
An alternative is requiring
the service provider to have independent audits
of its own compliance with industry standards.
For example, doing an SSAE18 audit report,
having that being completed
and the results being provided.
And once again, we're gonna look
at the SSAE18 in a future lesson.
Now, there are some third party agreements
that we're going to wanna have.
And so let's look at the first type of agreements
which are referred to as strategic agreements.
An NDA, an MOU, an MOA and a BPA.
An NDA stands for Non-Disclosure Agreement.
And that agreement establishes ownership
and protects information from unauthorized disclosure
and use both during and post relationship.
And we talked about an NDA when we were talking
about agreements that we might have with employees,
consultants or contractors,
people inside our organization.
That point we talked about it as an NDA
and also refer to it as a confidentiality agreement.
An MOU is a memorandum of understanding
that's a key word, understanding.
It's a non-binding document that really
outlines the intentions and the areas
of future cooperation between the parties.
A memorandum of agreement is binding.
It's a legally enforceable document,
that establishes a contractual
relationship between the parties.
And lastly, a BPA.
That's a business partner agreement.
It's really a fancy way of saying a contract,
but it's a comprehensive legal document
that outlines the terms
and conditions of the relationship
between two or more businesses or entities.
So NDAs, MOUs, MOAs, and BPAs.
And they're considered strategic
because they're really high level
documents that are setting
up the parameters of a relationship.
Then we have some tactical
third party agreements.
These are more nuts and bolts.
We have SLA, MSA, SOW and WO.
SLA stands for service level agreement.
And MSA is a master services agreement.
And SOW is a statement of work,
and a WO is a work order.
An SLA is a service level agreement
that codifies service
and support requirements
and may include incentives
for great work and or penalties
for not so great work.
An MSA is a master services agreement
and it outlines sort of general
terms and conditions and it serves as a framework
for future agreements or projects between the parties.
An SOW is a statement
of work that defines tasks,
deliverables, timelines and performance expectations,
for a particular project or an engagement
between the client and the service provider.
So the MSA is kind of the umbrella of your SOWs.
And then for each project you'll have an SOW.
And then work order is just transactional
and it's used for individual
service requests,
often within the context
of the ongoing business relationship.
So SLAs, MSAs, SOWs and WOs.
And that my friends brings us to a three second challenge.
Five challenge questions, three seconds each.
Let's do it.
An agreement that specifies the service
and support commitment.
One, two, three.
That's an SLA or service level agreement.
Number two, contractual clause
that agrees to allow an audit to be conducted.
One, two, three.
That is right to audit clause.
Number three.
An agreement that protects information
from unauthorized disclosure during
and post relationship.
One, two, three.
That's gonna be an NDA, a non-disclosure agreement
also referred to as a confidentiality agreement.
Number four.
An investigation of a business
or person before entering into a contract
and during the lifetime of the relationship.
One, two, three.
That's gonna be doing due diligence.
And lastly, number five.
Used to document individual service requests.
One, two, three.
That's gonna be a work order.
That brings us to a security-in-action.
And this one's about due diligence.
Now your organization has plans
to outsource the hosting
of its online store.
Now you've been asked to conduct
the cybersecurity component
of the due diligence investigation.
What areas would you focus on?
Okay, so just a quick recap.
We're gonna outsource the hosting
of our online store.
So we're looking at a number
of different vendors I assume
and we're gonna be doing some due diligence.
And you've been been asked
to conduct the cybersecurity
component of the overall
due diligence investigation.
So my question for you is,
what are you gonna focus on?
Go ahead and put me on pause
and think about what your focus is gonna be.
Well, it's critical that the third party security
posture is strategically aligned
with the needs of the organization.
So you need to know what your requirements are,
so that we can assess the third party.
So areas to focus
on are going to include their controls environment.
Again, what controls do you want them to have?
Compliance requirements,
if there are any compliance requirements,
do they understand those compliance requirements?
And can they honor those compliance requirements?
Do they do assessments?
Not just their own assessments
but do they have independent assessments?
And are they willing to share the results
of those assessments with you?
And how often do they do them?
Do you have the right to audit?
Meaning the right to actually go
and do an audit on a specific basis,
like an annual basis
or if there's a particular complaint
or are they willing to provide
to you a comprehensive SSAE18 audit report?
You wanna learn about their end
of support and end of life policies.
You wanna understand what their vulnerability
management program looks like
and how often do they disclose vulnerabilities?
And do they have a good proactive history of,
you know doing responsible disclosure?
And then how often do they release their patches?
And then how are they gonna handle incident management
and do their incident response
and management protocols, do they work with yours, right?
Can they work together?
And lastly, their business continuity.
What is their ability
to continue to provide service
in the event of an outage
or disruption of their organization?
So those are all the things
we're gonna look at for,
at the service provider to make sure
that they can provide the adequate level of service
and compliance and controls.
Being able to do this,
security-in-action.
All right.
There's your word cloud.
Make sure that you really
know all of these terms, right?
Any one of them could come up in your exam.
So you wanna understand them
and be confident in them.
And then when you're ready,
well, we only had one lesson
in this lesson, so head on over
to our five question quiz.