Third-party Risk Management Procedures

This manages the risks associated with third-party partnerships, security of sensitive information, and compliance with regulatory requirements.

Step 1: Identify third parties

• This lists all third parties including but not limited to vendors, suppliers, contractors, and service providers.
• This categorizes third parties based on the following: services they provide, access to sensitive data, and impact on business operations

Step 2: Conduct Risk Assessment

• This evaluates potential risks associated with all third parties. This covers financial stability, legal compliance, cybersecurity practices, and operational reliability.

Step 3: Assign risk ratings and document relevant information.

• This assigns risk ratings to third parties to establish prioritization of threats.

Step 4: Request documentation from the third party

• This reviews third parties’ security policies, financial stability, legal compliance, cybersecurity practices, and operational reliability.
• This ensures that the team has access to the following documentation but not limited to security certifications, audit reports, and security policies. 

Step 5: Develop contractual agreements.

• This develops and outlines contracts that cover the following but are not limited to the roles, responsibilities, service level agreement, implemented data policy and security measures, compliance, and incident response.
• The contractual agreements must cover the following: terms for risk management, such as the right to audit, breach notification requirements, and termination clauses.

Step 6: Implement continuous monitoring and conduct regular audits.

• This monitors third parties for changes in risk profiles. This also performs audits and assessments to ensure that third parties adhere to contractual agreements.

Step 7: Implement Incident Response Procedure and Breach Notification Procedure

• This follows the Incident Response Procedure and Breach Notification Procedure. Please read the Incident Management Policy and Breach Notification Procedure for more detailed information.

Step 8: Develop and conduct risk mitigation measures

• This creates measures to mitigate risks through implementing additional security controls, requiring third-party training, or diversifying suppliers.
• This applies the necessary measures to reduce risks to acceptable levels.

Step 9: Create and maintain the reporting and documentation process

• This enables the team to maintain detailed documentation of risk assessments, contractual agreements, and ongoing monitoring efforts.
• This reports to relevant stakeholders about the mitigation efforts and compliance status.

Step 10: Conduct a review of processes related to third-party management

• This requires the team to review and update third-party risk management processes to ensure they remain effective.