6 ways to keep up with third-party management risk, in real time
As third-party web and email servers, databases and other business functions become commonplace in today’s connected world, such partnerships bring vulnerabilities as well as convenience.
Even industry giants such as Amazon, eBay, PayPal and General Electric have found their third-party databases and vendors hacked, with the attacks used to post sensitive data and propagate bogus offers. Since as early as 2015, cybercriminal group Magecart has infected third-party web servers used by major airlines and online ticket platforms to steal sensitive data like credit card information.
With the rise of such threats across the supply chain, organizations have responded accordingly. They’ve conducted their due diligence of prospective vendors. They’ve completed assessments after an incident takes place.
These practices are an important foundation. But they’re only isolated safeguards measuring specific moments in time. Market conditions, vendor business models and the geopolitical environment are changing by the month, or even the week—and cybercriminals are targeting supply chains 24/7. In today’s world, organizations need a more comprehensive approach to third-party management.
Like a Fitbit for Your Digital Supply Chain
Think of third-party monitoring like keeping tabs on your personal health. While annual check-ups are invaluable, health conditions and their warning signs often emerge between visits. That’s one reason devices like wearables and health data apps have become so popular. They help people spot anomalies in vital health readings — and get ahead of the situation — any time of day or night.
Continuous risk monitoring across a global corporation’s digital supply chain is much more complicated, of course. Comprehensive oversight requires policies and procedures as well as high-tech dashboards and alerts. It also requires time, talent and organizational commitment. But such an investment yields multiple benefits.
With an integrated 3PM monitoring solutions, organizations can:
- View third-party risks as they emerge — and across the business
- Assess the effectiveness of risk management efforts, including costs
- Access reports and relevant data faster if a vendor falls under legal investigation
- Strengthen their position to get the value they expect from vendor relationships
6 Best Practices for Monitoring Third-Party Health
1. Get ahead of complaints.
What are consumers saying about your third-party vendors? Their reputation is your reputation, especially in areas like data privacy and security, and if word on the street is negative, you need to know — sooner rather than later.
Of course, not even the most robust compliance department has the time to monitor Twitter, various company review platforms and the business press all day (and night). Fortunately, reputation monitoring and business intelligence tools are available to do the work of thousands of eyes and browsers, in real time.
2. Make breach alerts a business condition.
Compromised data in a vendor’s system can soon turn into a massive vulnerability for your company in terms of regulatory compliance, reputation, customer confidence and more.
But there’s no need to wait for an incident to take action — or to go it alone. Get ahead of potential crises, and share responsibility with your vendors, by strengthening your contracts. Work with your legal department to incorporate protocols for data breaches, including timely notification, to your standard terms and conditions.
3. Use technology to expand the view.
Just as health and wellness apps can funnel data on sleep, nutrition, heartrate and more into one smartphone or smart watch screen, 3PM monitoring tools can similarly deliver quick, one-stop visibility into vital risk and compliance metrics.
4. Keep an eye on leadership and litigation.
A new person at the helm of a vendor company can shift its strategic direction—and the services you rely on. Meanwhile, litigation against a vendor or an unexpected bankruptcy can potentially put these services at risk, leaving your company scrambling to fill the void.
Furthermore, if either of these developments become public knowledge, you may soon experience questions from, and a crisis of confidence with, customers, stakeholders and
the media, potentially damaging both your reputation and your bottom line.
As with data breaches, establish protocols in your vendor agreements for timely, thorough notifications, so you’re sharing the responsibility and giving your organization time to react and respond.
5. Check regularly for rulings and enforcement actions.
Has a regulatory agency failed to renew an important license or certification? Are local court or government rulings putting a vendor’s operations, and their services for your organization, at risk?
Rulings and enforcement actions across your supply chain are serious business, and you need to be ready for tough conversations and an alternate plan if necessary. This is important work, but it doesn’t need to be unnecessarily onerous. As with reputational intelligence, specialized tools and databases exist for tracking regulatory developments and actions relevant to your company and industry.
6. Stay current.
Is a vendor up to date on the latest security practices and certifications for protecting sensitive data? Are they hiring professionals with the skills and licenses needed to get the job done? In today’s rapidly changing world, you can’t answer questions like these with yesterday’s data.
In conclusion, just as digital transformation has opened the door to added third-party risk, digitization can be part of the solution as well. Tools are out there that put all of your third-party data in one place, for comprehensive visibility into risk levels, risk types, approval statuses and more. Meanwhile, automated, customized questionnaires, profiles and more can add efficiency to every stage of the process, from due diligence and onboarding through ongoing tracking.
Diligent’s Third-Party Management Compliance solutions are designed for easier monitoring, management and peace of mind. Learn more.
