Cómo afectan los recientes cambios normativos a los programas de gestión de riesgos de terceros

Amanda: Hello everyone trickling in. Amanda: Welcome to prevalence webinar series here. Amanda: And I’m going to hit you all with a poll question while I start doing these introductions. Amanda: And we like to call this while you’re waiting. Amanda: We’re curious what prompted you join this webinar today. Amanda: Education project research. Amanda: You have an upcoming project. Amanda: Oh, that was a hot immediate. Amanda: Yes. Amanda: So, that’s exciting. Amanda: Um, you don’t know where you are. Amanda: Where are you? Amanda: You’re I’ll tell you. Amanda: You’ll learn something. Amanda: And you’re a prevalent customer, which is always nice to continue on your education with what you are using, right? Amanda: So, I’m going to keep that up for a hot second and let me know. Amanda: You guys can see my screen, right? Yaffy: Yes. Yaffy: So far, it says, “How recent regulatory changes impact third party risk management programs.” Amanda: Wow, that’s really exciting. Amanda: Thanks, for reading that Yaffy. Amanda: Um, yeah, that’s what we’re talking about today. Amanda: So, that is the topic and we have two great speakers here. Amanda: It’s going to be like a Q&A for everybody, so pay attention. Amanda: And I’m gonna change the screen over here. Amanda: Here we go. Amanda: Here are your speakers. Amanda: We have um the one and only Mike Yaffy here, our very own CMO at Prevalent, who will be asking questions to Alpa Enamdar, who is the transformation leader at AIG and for the last 10 years she’s heavily focused on third party risk management and as a disclaimer for everybody just want you to know that this is Alba’s own perspective it’s nothing attached to AIG so just be very aware on this and a couple of housekeepings while we get started you guys you’re all muted but please use the Q&A to ask as many questions as you like we’ll use them towards the end of the session um we have the chat as well this is all being recorded. Amanda: So, even if you’re not exactly paying attention or maybe you have to hop off or you want to share it, it’ll be in your inbox later today. Amanda: I will personally be sending it to you. Amanda: And I am Amanda and I am in business development here at Prevalent. Amanda: So, I have one more poll question that we’re curious about in order to get this one started here. Amanda: And we are going to launch it right now. Amanda: And we have another curiosity. Amanda: We want to know what percentage of you of your organization’s time is currently spent on thirdparty risk management. Amanda: It’s a single choice question and it’s a range obviously as you can see already a lot is 0 to 33% you guys just as an FYI. Amanda: I’m going to give it 20 more seconds. Amanda: You guys are very active. Amanda: So thanks everyone for paying attention here and using this and I’m going to end it now. Amanda: It looks like heavily I’m going to share the results heavily zero to 33%. Amanda: So that’s guys are here. Alpa: To those three people that answered 60 to 100% of the time, I’m sorry. Amanda: Well, I’m gonna kick it over to you, Yaffy. Amanda: Thanks for Yaffy: That is great. Yaffy: So, a couple things. Yaffy: One, you know, I need a better I need to get rid of this gray. Yaffy: And I said this on the wear, but that’s, you know, you can see all the grays coming in, so the picture is a little old. Yaffy: And two, I live in Boston, but I did get a chance to uh meet somebody from the Dodgers a while ago. Yaffy: So, big Red Sox fan. Yaffy: I was at the game last night and I’m basically talking about two teams that are probably going to get blown out next game. Yaffy: So, we’re looking at Houston and Atlanta, right? Yaffy: So, um so thank you for uh being here everybody. Yaffy: Look, we can we have about 10 questions, 15 questions we’re going to try to get through. Yaffy: I can handle checking the Q&A, so if something comes up um but we’re going to try to, you know, rapid fire, get through these, ask a bunch of questions. Yaffy: If there’s something you have to know, you know, set it in uh send it in via the chat function and I’ll try to get to it. Yaffy: If not, we’ll get to it at the end. Yaffy: But Alpha, let’s kind of first thanks for being here. Yaffy: Um, let’s just jump right into it. Yaffy: So, what are you seeing in third party? Yaffy: You’ve been doing this for over a decade, right? Yaffy: Talk about kind of where you’re seeing any changes, any movement in the industry and we lot and those are going to be three discussion topics relative to this question. Alpa: Perfect. Alpa: Well, first of all, thank you so much. Alpa: Really excited to be back um to do this. Alpa: question. Alpa: Um, and look, I think the question you’re asking is extremely critical, right? Alpa: What are the trends? Alpa: And before I really kind of start going deep into the some of the trends that I’m noticing, I did want to give a little bit of background, right? Alpa: Look, I’ve worked for 20 plus years experience in different industries. Alpa: So, I do have some of my perspective thinking about from manufacturing, aerodyn as well. Alpa: So some of the trends we’re seeing currently is you know as probably one of the hottest topic is our cyber attacks right cyber attacks are on a rise we’ve got cyber attacks on cloud services with about I think approximately I think I read an article about 198 million malicious IP detected um as we see what’s happening either with solar winds um where you know people are getting extremely as I call intelligent in breaking supply chain data management process so how do we manage the right controls and the right data being on the web. Alpa: The other thing you’re going to start seeing is the resiliency, right? Alpa: I think one thing that we learned was and that was probably one of the biggest trends um if I look at is how was this trend on operational resiliency. Alpa: So in the past what we’ve seen is a lot of business continuity planning and when we do these BCP um scenarios or the tabletop exercises they’re usually a singular activity, right? Alpa: So either you have a hurricane, either you had a 911. Alpa: Um, never have we felt or you know actually faced a pandemic where it affects every single industry, every single country and every single human being at a similar time frame and thus I think the trend now is do you have the right resiliency within your organization and what are you doing about that? Yaffy: So it and I get and I think that’s the fair question that’s the right question we’re talking about. Yaffy: supply chain supply chain resiliency vendors. Yaffy: So, let’s drill into it. Yaffy: So, Yaffy: look, most people are struggling, most of the folks that we work with, Yaffy: right? Yaffy: They’re struggling to get all of their tier one vendors into some type of repetitive and consistent assessment, either scoring or the actual assessment, right? Yaffy: So, when something happens like a solar winds, right, you’ve got people over here that are barely getting to tier ones, and you’re not alone out there. Yaffy: And then over here, you have potential breach that could affect some unknown amount of your vendors. Yaffy: How how do people resolve this gap? Yaffy: What’s the what’s the recommendation here? Yaffy: What’s the course of action? Alpa: No, and I mean it’s great because look um most organization had an extreme challenging time, right? Alpa: Because exactly like you said, if you think about especially as I call bigger financial organizations, right? Alpa: They’ve been there for a very long time. Alpa: You have these antiquated legacy infrastructure and you don’t have a good rep. Alpa: repository of all your vendors in general, right? Alpa: Because you have some things that are going through your accounts payable directly where it’s not going through a system. Alpa: Um, majority of the organizations, uh, not just financials, but even manufacturing, they don’t have one system, right? Alpa: So, we don’t have a one repository, which makes it that much more challenging, Mike, right? Alpa: Because you have a legal and contracts in one system. Alpa: You got some of these vendors that are somewhat deemed to be critical for some businesses in a different system. Alpa: Then you got an overall arching system that doesn’t connect across the organization and then on top of that like you said once you know your tier ones in some of these especially like Solar Winds they might not be a direct vendor to you but they might be a fourth or a fifth party to some of the vendors that they provide the critical services to you. Alpa: So this is where that challenge is right because you don’t have one transparency fully on your third party itself on the vendor and then into as I call it’s called the spider or you know spider web or spaghetti um in a sense of you have so many other fourth fifth and parties that the vendors have you don’t have the transparency in order to be extremely proactive when something like solar winds or you know the national um pipeline or the AXA breaches happen because by the time you actually go through all the data it is you know sometimes you’re not even getting to the data Um, and we’re literally calling our vendors up um, in a manual process and saying, “Hey, we’ve seen this in Solar Winds. Alpa: Are these your fourth parties or your fifth parties?” Alpa: And they’re like, “I’m not sure, but here are some of the vendors that we deal with.” Alpa: And then you kind of take that next step and call them up and try to find out. Yaffy: So, what’s the recom so so clearly articulated the problem, but so what’s the Yaffy: what’s the the the remediation? Yaffy: Is it you just you have to be identifying your vendors at all times? Yaffy: Is it You have to put a structured plan. Yaffy: I mean, Alpa: no, I think there’s bunch of things, right? Alpa: You have to put a structured plan. Alpa: You have to know your vendors, but I think you also need to do extra due diligence when you’re onboarding these vendors. Alpa: So, now what you’re going to start asking is, can I see some soft reports, right? Alpa: Can I see the SSE8? Alpa: Um, because that was introduced in 2017. Alpa: So, I think now you got to look at the annual reviews and make sure that you know your assessments aren’t just done on annual basis where you’re frequently talking to your critical vendors. Alpa: and getting this due diligence and the right information. Alpa: So like what you just said Mike is how do we then address once you have the Yaffy: because it’s always after the horse has left the barn. Yaffy: I think the one thing that you said for me here is look on onboarding it takes no effort as not no effort but right it it makes a lot of sense to just say look I need a list of all your major operating platforms. Yaffy: I need a list of all of these things that so it’s quickly easy it’s easily correlated if something happens you can at least go to your vendors or there that I like that and as you can tell we hadn’t discussed this previously that is an answer so that that actually makes a lot of sense Alpa: but you know it’s hard too right because think about it most and again bigger size organization for 500 you’re talking about anywhere between 3 to 10,000 vendors Mike so keeping that data Yaffy: you know we talk to people who are like I have 30 tier vendors and you talk to people like and I can say this publicly because they’ve done stuff Yaffy: They have Lowe’s and Fizer and a few others, you know, thousands and thousands and thousands of vendors. Yaffy: So, you know, they might be trying to do 30 vendors a day where that’s somebody’s universe. Yaffy: So, it’s Alpa: Exactly. Alpa: Um, but no, but I think you, you know, you have to, you know, because we did the on-site assessments, you did your due diligence, you use your SIG as a questionnaire, but you have to do additional, right? Alpa: And CO has kind of highlighted that more than anything, saying, you know, it’s not good enough to just go and ask these as I call due diligence questionnaires once a year and thinking that those organizations are still actually you know in the market. Yaffy: Yep. Yaffy: So ESG so a lot of people are talking about ESG. Yaffy: You know we’ve talked to Gartner regularly and everybody’s everybody wants to be you know socially responsible and doing it. Yaffy: I and I think at some point people will get to doing it and maybe it’s just us but I’m not seeing a ton of people doing it. Yaffy: I’m seeing a lot of people talking about thinking about doing it. Yaffy: Like where are you at? Yaffy: How do you Where do you see this right now? Alpa: Yeah. Alpa: No, I think ESG has become, you know, like you said, I think it’s become critical. Alpa: I think after Larry Frink’s um, you know, letter to the CEO, right, with the net carbon footprint by 2050 Alpa: um, you know, and every organization like you said, either it’s you know, biotech, if it’s um, aerodynam um, but what is the actual tangible action? Alpa: I do think ESG becomes somewhat easy when you’re in manufacturing, right? Alpa: Because you can look at your between plants, you can look at the car footprint, you can look at your production lines. Alpa: It gets a little bit um as I call challenging as we move to the financial industry. Alpa: And the reason why is because everybody keeps saying I’m environmentally focused. Alpa: But what does that mean, right? Alpa: What are you measuring and how are you measuring that? Alpa: So, you know, we’re going to be emission free by X, but what are the, you know, how many tons and what is the right criteria? Alpa: And I don’t think because we don’t have specific metric directs that we are being evaluated right now. Alpa: People are just struggling to figure out what is that ESG for that organization. Alpa: And the second thing is I regulators will get more and I think you will see a trend eventually that regulations will follow the ESG with the specific criterias and metrics where I think organizations then can say I am ESG focused. Alpa: But right now I think there’s much more conversations we are moving towards because I think the leadership and the board does want to make sure that they comply with the ESG policies, but I think we’ll see more coming up in next two, three years to be honest. Yaffy: Fair enough. Yaffy: Um, and I agree. Yaffy: I don’t I think it’s important it’s coming. Yaffy: It’s probably, but you got to get your kind of house in order. Yaffy: Amanda, can you flip over to the next question? Yaffy: So, look, we’ve had you you’ve already alluded to this and talked about the massive supply chain disruptions with COVID, but, you know, I feel like we’re failing to learn the lessons of the past, you know, you’re like, “I’ll never do this again.” Yaffy: And you know, it’s like when you say, sorry, when you say you drink too much in college, you’re like, “I’ll never drink this much again.” Yaffy: And then, you know, two weeks later, you’re like, “I did it again.” Yaffy: Um, Yaffy: so, you know, have we learned the lessons? Yaffy: Have people diversified their supply ch their supply chains? Yaffy: Have they are they truly engaging with their vendors, their third parties, their fourth parties? Yaffy: I mean, how far would you say that co has pushed in a positive way. Yaffy: Have we regressed at all? Yaffy: Just where do you see um Yaffy: No, I mean look, I think postco even though we’re not, but where do you see it? Alpa: Right. Alpa: Exactly. Alpa: No, but you’re right. Alpa: I think um you know, we as human, we have a tendency, right? Alpa: We kind of forget very easily. Alpa: Um and especially if it’s a painful process, we forget that little bit faster. Alpa: Um so how do we change that process? Alpa: And I think what has happened with COVID and why there I think these lessons are learned and will retain. Alpa:** Um because we all at some some point felt the pain. Alpa: And what do I mean by that? Alpa: Because it affected all industries, right? Alpa: We all at some point either went to a grocery store and there was not enough either, you know, paper towels or purels or anti, you know, sanitizers or um even meat for that matter, right? Alpa: Anything. Alpa: It was across the board. Alpa: And people knew how critical supply chain disruption affects their daytoday life. Alpa: It also affects the reputation of the organization. Alpa: Right? Alpa: So if you hypothetically go today to a store and they don’t have a specific product, nobody’s going on that product, they are branding the store saying they are not doing their due diligence and they’re taking the accountability. Alpa: And I think that’s what’s happening in the organization, right? Alpa: Because the reputation is so high, they have to make sure that they invest properly. Alpa: And I think what they’ve learned is after COVID, right, they didn’t have a good control. Alpa: So now how do make sure that one we have a good repository of our vendors. Alpa: How do we make sure that we are constantly in line with these vendors in a sense of the services they perform? Alpa: Are they really critical? Alpa: Because in the past we’ve had records where you had critical vendors that didn’t change for you know decades Yaffy: right Alpa: now after co that critical vendor might to be honest might not be the one I’m worried about because they’re fortune 100 or fortune 500. Alpa: So for example Microsoft wasn’t going to go anywhere. Alpa: Yes co it affected them. Alpa: But you might have had to sh you had to shift your power to these smaller companies. Yaffy: You know, to me the question is and do you see organizations and I and I guess organizations by that I mean board executives do you see people saying hey look we have to baseline our our vendors here. Yaffy: There’s too many risks to our business. Yaffy: Is it is it being taken more seriously at the board by the executives? Yaffy: Because look in some cases Yaffy: You know, the folks that I already mentioned, they take this super seriously. Yaffy: In other cases, they’re like, it’s 15th on a line of in the line of and I’ve been in infosite for 20 years. Yaffy: I mean, that’s always the case, right? Yaffy: You’re like, take a number. Yaffy: It’s like the deli counter, a joke, right? Yaffy: Take a number of the deli counter. Yaffy: I’ll call your name and number when you’re ready. Yaffy: And sometimes it’s it’s number one, sometimes it’s 12. Yaffy: But what I mean, 30 seconds on that, and I want to get over to the Alpa: Yeah. Alpa: No, I agree. Alpa: I think look, they are now more and more like you said, the ongoing modernity is critical. Alpa: So, the leader ship is looking at it because the more vendor the more risk but at the same time you also have to look at your concentration risk so I think there’s a balance right Mike it’s not only Alpa: my concentration risk Alpa: so you don’t want to only have four vendors that and I’m just making this a hypothesis but if you only have four vendors you’re focusing all your services on and if two of them go down now you’re affecting your whole organization right so you are putting all your eggs in one basket as I would call it and so you have to be careful that you don’t have too many but you can’t have so little that that could impact your dayto function as an organization. Alpa: Um but we do need to look at it because you like you said you have a lot of vendors who are providing a very similar services and you do need to consolidate them and you Yaffy: good point. Yaffy: Uh next question. Yaffy: So you had said you know we were doing the prep and then you’re like I I need to talk about continuous monitoring. Yaffy: It’s a game changer. Yaffy: So platform is yours. Alpa: Okay. Alpa: Awesome. Alpa: Well look I as you said you know what are the trends? Alpa: What are we seeing? Alpa: Look we have to move away from this manual question. Yaffy: Sorry question before. Yaffy: find what you mean by continuous monitoring because there’s look in in thirdparty risk there’s kind of that that continuous scoring there’s business risks and then there’s assessment so like you know I I assume nothing so define it then tell people why it’s Alpa: sure so look I mean so what I’ll define it this way continuous monitoring is when we originally started looking at third party governance right we would usually look at one single point of time right so you look at a vendor in January and then you look at them based on criticality March April whatever next year here. Alpa: Now the approach when you say continuous monitoring is pretty much what you’re looking at is every single vendor critical vendors you have your monitoring on a daily basis with real time alerts. Alpa: So it is not looking at one point of time it’s not going through a questionnaire but it’s going across that vendor and saying if there’s an impact either from an IP address that they have an issue either there’s a service disruption either there’s a hurricane that’s going to affect them Continuous monitoring gives you that realtime alerts based on the specific regions and vendors and exactly what Mike you said is on different risk factors, right? Alpa: So environmental, operational, compliance, finance. Alpa: So it looks across all of those and why this is critical or a game changer is because as more and more data you have, you’re not going to be able to allocate thousands and thousands of people to go out on the web and keep searching what are the potential risks. Alpa: So by being as I call technology smart or technology savvy, you will use some of these tools that are out in the industry where they’re going to do continuous monitoring where they give you these alerts and then you proactively can take an action based on those alerts. Alpa: Again, Yaffy: you know, it’s funny. Yaffy: I remember when so I started in v uh vulnerability and penetration testing and security 100 years ago and all this stuff used to be on spreadsheets. Yaffy: And I hear this now people are like, “Oh, keep it all on spreadsheets.” Yaffy: I’m like, you know, the it matured. Yaffy: You know, a a and this this isn’t related to prevalent, but guys, getting a platform or help or a managed service or something so you can scale. Yaffy: The whole thing is you don’t want to be doing this tactical hunting down of stuff. Yaffy: You need information that you can make effective decisions with, right? Yaffy: And you can’t spend, like I said, I’m sorry for those three or four of you that are uh spending, you know, twothirds of your I guarantee you’re you’re spending all your time sending emails back and forth. Yaffy: So, um, Ela, we did have a quick question. Yaffy: It just goes right back to somebody asked you, uh, from anonymous attendee. Yaffy: Thank you, anonymous attendee. Yaffy: Uh, vendor concentration. Yaffy: They were talking about how about, uh, cloud with the top three AWS, Google, and MS Azure. Yaffy: So, um, does that I they didn’t they were asking about it, but does that create a disproportionate dependency in your mind? Alpa: It does. Alpa: It significantly does, right? Alpa: Um, but again, because we talked about scale, right? Alpa: All three of them have scale and thus we have a heavy reliance on all organization on those three and that is going to impact at some point and this is where like you said if you think about your weakest link this could but at the same time do you want to take a risk going to a smaller organization where you don’t have transparency where they’re storing your sensitive confidential data in a cloud. Alpa: So we rely on the top three right now but that’s a great question. Yaffy: Right on. Yaffy: Let’s get to the next one. Yaffy: Amanda, I do want to get into some of the regulatory stuff. Yaffy: So, uh, you know, there’s banking laws in England, there’s GDPR. Yaffy: You know, we did, and it was, you know, sometimes you’d rather be lucky than good, quite frankly. Yaffy: But we did a, uh, a NIST webinar with our content expert here, just the updates and changes to NIST, and we usually have like 300 people register. Yaffy: We had like 625 people register. Yaffy: So, I’m like, Yaffy: being the marketing guy that I am, I’m like, hey, we should we should do some more NIST stuff. Yaffy: But, It does seem like NIST, PCI, uh, CCPA, a few others are Yaffy: dispro Look, I I get third party that generally the audit or the the the legislation or the guidance drives this behavior, but can you talk about which ones you’re seeing in the US, which ones you’re seeing internationally, Yaffy: why, how come? Yaffy: So, feel free to spend a little time on this one. Yaffy: I think the ones, you know, if people like there’s 50 of them, which one what are the two that I kind of use as guidance so would love to hear your thoughts Alpa: yeah I think there’s about three of them that I would say are you know in two globally um one US specific um but you know the one I’ll start with the EBA sourcing and you know mainly again on the global front but and especially in AMIA to be honest but this is about all outsourcing arrangement right it’s including your cloud outsourcing and the question we asked and the subcontractor and the written register so How do we make sure we record all your outsourcing engagements? Alpa: And this is Mike, if you think about the first question you asked about the fourth parties because when you’re saying subcontractor, that is your fourth and fifth and the nth parties. Alpa: So now at least within AMIA, they have been starting to really kind of come heavily focus on this EBA sourcing and most organizations are having a really hard time and they’re struggling. Alpa: Um, and what and how to solve this issue is now they’re going in their process of onboarding ing and then ongoing monitoring. Alpa: They’re asking these questions to get the data, but we’re not getting it fast enough. Alpa: So, I think EBA sourcing is here to stay and we’re going to spend more and more time on it. Yaffy: Why is it here to stay? Yaffy: Why do you think I mean what makes it different, special, unique, Alpa: right? Alpa: And because it’s because your reliance on other parties, right? Alpa: Because more and more organizations are either doing managed services or outsourcing. Alpa: And if you don’t have a good control wherever based on locations, the services um the data integrity of it You will have more risk as an organization and the regulators don’t feel comfortable enough at this level that most companies have a good control of those subcontractors and even the cloud registry. Yaffy: Fair enough. Yaffy: And we’re going to use cloud. Yaffy: You know, the cloud’s not going away. Yaffy: Neither is cyber. Yaffy: So, you know, in that element that Alpa: I’ve heard that I’ve heard that it’s probably here to stay, right? Yaffy: Yes. Yaffy: Exactly. Yaffy: This cloud thing is going to catch on. Yaffy: I think it’s I think it’s I think it’s real. Alpa: Yeah. Alpa: And then the other one is, you know, look uh DORA right which is um stands for digital operation resiliency act and this is to really consolidate and upgrade your information communication technology so it looks Yaffy: where is that one out at like is that a U like where’s that one Alpa: that one’s um mainly from Europe Yaffy: okay Alpa: but it’s affecting all globally because I think it’s coming here as well so we have to be kind of watching out and the reason why this came in is because what they were looking at is risk across all financial entities to ensure that they have a common standard. Alpa: So if a single cyber incident occurs, it could lead to a systematic risk that threatens the financial stability across the firm. Alpa: Right? Alpa: So that is the reason why this is spreading and again a lot of the regulations you’ll see AMIA is much more ahead and then we get it after they’re also asking a lot of ESG metrics that we haven’t seen yet and that’s going to come through on the US side. Alpa: You know modern slavery has And another one Alpa: um we’ve really started because now that kind of gets affiliated with ESG as well but it’s mainly how do we practice the use of the violence and you know the abuse of exploit of people right so between human trafficking child labor how much you know do you have an understanding when you’re going to these fourth fifth parties especially internationally but again US is pure solely responsible in a sense of if you are based out of US you do need to make sure from a regulation perspective that you have the more modern slavery act and you’re compliant with it. Alpa: A little bit harder to do again similar because you know are you literally going in every single vendor and saying you know are you you know this child labor it’s not as easy to get this kind of information but I think that’s another one we’re going through and then I think look um FFIC right um lots of stuff it’s covering finan especially financial institutions so if you think about um business continuity planning now it’s gone to the next level where they’re saying is show me your plan for your hardware and your cyber attack that those were not there 10 years ago. Alpa: If you think about acquisitions, you know, what is the standard practices when you’re acquiring um these companies and do you feel comfortable from a cyber perspective that they have the same mitigance and controls um from access sensitive data what’s going out and in from their systems. Alpa: Um anything on operational risk um is another big one that you’ll see in FFIC um that I think will have a significant impact. Alpa: So I mean look look bunch of them as you will see more and more um either it’s OC bulletin you know I think it’s 2017 um if it’s the GDPR um if it’s article 28 all of them are talking about confidential sensitive data how are you managing this data and what controls do are you giving back to make sure that the consumer feels comfortable that the data is not being shared and used for other purposes Yaffy: fair enough we got a a quick question and I think it’s a clarification question from Christopher. Yaffy: Christopher, thank you. Yaffy: Looking at regulation, how would you define material and how would you define critical? Alpa: Sorry, can you repeat that? Alpa: I lost you for a sec. Alpa: My Yaffy: Yeah, no worries. Yaffy: Uh, and I’m going to ask back toback questions. Yaffy: Another one just popped up. Yaffy: Uh, looking at regulation in general, how would you define material and how would you define critical? Alpa: So, you know, look, the critical ones are what is going to impact your business and services and that you will have a consent order, right? Alpa: So, those are as I that are critical and the regulators as and I’m not sure but I just want for the audience perspective when you’re looking at regulations from a financial industry perspective you have three specific um regulation impact that can be affected in your organization you have MRA which is material risk action you have MRI material risk immediate action and then you have the consent order so based on the criticality there is a significant impact if you do have a consent order you will not be able to do the business in the industry. Alpa: So naturally and we’ve seen this across right what just city has gone through with all the MAS the consent orders they’re going through and city is not the only one we’ve gone through a lot of them either it’s JP HSBC you know across the front so I think that’s what it is the material is we clearly see if you’re not going to focus on within next and they have a time frame anywhere between six months to a year where these material actions are not resolved that it could have a significant impact. Alpa: So criticality, consent orders, materiality is look at these regulations from what kind of repository what you have, what kind of controls you’re putting in, and then do you have the right access to make sure that this is materiality. Yaffy: Uh, somebody quickly wanted to know they misunderstood the first regulation. Yaffy: Did you say ADA, ABA? Alpa: EBA is in Emily, B is incorp in banking. Alpa: Um I think it’s association. Yaffy: Right on. Yaffy: Uh Amanda, let’s bang over to the Oh, somebody thought uh one quick question. Yaffy: I thought MRA as we go to the next question meant matter requiring attention. Alpa: It is matter. Alpa: Sorry. Alpa: It is matter. Alpa: Good catch. Alpa: Thanks for keeping us honest, but again, we’re not Yaffy: You’re paying attention, but we’re not going to bust anybody’s chops for the slight difference in terms. Yaffy: So, Yaffy: look, you’ve been doing this longer than most people. Yaffy: Um Yaffy: what what do you see are like the just the things you’re like God if I could just tell everybody in third party like do this don’t do this and let’s do the let’s do the I see the critical mistakes and then everybody needs to do this. Yaffy: So yeah so I think look a couple of things and in this one I can actually do a whole session Mike just because there’s so many things I have a list of schedule another one the dos and Right. Yaffy: But let’s so look Alpa: third party u management risk management is not a checkbox exercise anymore right you cannot you know what you did a couple of years ago where an organization just said is hey you had a small group that just kind of looked at vendors and we had a list of you know did you onboard a client check do you have a contract check um did you do your on-site assessments check it’s more than that right you have to understand the impact across all businesses it’s not siloed anymore it has to be unified it has has to be more strategic and you have to have the right people invest in the right talent to make sure that they understand the risk accordingly. Alpa: So that’s my the don’t and the do in a sense of invest in the right people and technology because we cannot do the Excel spreadsheets. Alpa: The other one is really Yaffy: but thank you for saying that. Yaffy: I was just literally so like if you’re in spreadsheets are you behind Alpa: you are extremely behind because you’re not going to be able to and especially now with the speed of changes that are occurring in current environment. Yaffy: Yeah. Yaffy: I mean, you can’t you’re not keeping up, I I would imagine, with basic baseline program, you’re probably not doing all your vendors, let alone, you know, or your tier ones, let alone all of them. Yaffy: So, and I would agree with that. Yaffy: I mean, most of the people, it’s funny, most of the folks that we work with fall into two categories. Yaffy: They’re um they’re still in spreadsheets and they realize that they’re doing it or they they tried to spin something up and failed and they’re like, “Look, All right, we we didn’t get it right. Yaffy: We have some money to spend. Yaffy: We’re looking to, Yaffy: you know, look, help us. Yaffy: I And the one thing I I have to say, and I always say this is you have to start with the program goal in mind and then work backwards, right? Yaffy: And to me, that is the thing like why are we here? Yaffy: What’s the outcome? Yaffy: Is it tier ones? Yaffy: Is it identifying? Yaffy: Is it all your vendors? Yaffy: Is it how are you thinking about success? Yaffy: How is your management, your board going to define success? Yaffy: And how are you going to report on that? Yaffy: Okay, great. Yaffy: Now, let’s go to the beginning of the process. Yaffy: process and sorry that’s just you know we’ve been doing this forever here so I I see that a lot Alpa: the other one is I think look we cannot rely on this a single point I’m big proponent you have to know your vendors on a dayto-day basis especially the critical ones we cannot sit and saying we did x and you know wait for it because we saw especially in last 18 months how many vendors went under because they didn’t have a strong balance sheet or they didn’t have the liquidity right and you cannot wait for a year or two and have the impact to your businesses and not be able to react. Alpa: So I think it’s being continuously or ongoing monitoring these vendors and have a pulse with them I think is going to be extremely critical. Alpa: The other one is the right governance. Alpa: So let’s say you do find out there’s issues with certain vendors, what are you doing with it? Alpa: Who is getting notified? Alpa: Because a lot of the times what I see the falling on this third party why people fail is we have an issue but I don’t know who to escalate or I’m escalating to the wrong people. Alpa: So, hey, there’s a cyber threat or there’s a cyber breach. Alpa: I’m just going to go to it and let them figure it out. Alpa: So, hey, IT, information technology, I saw this incident. Alpa: Have you connecting within your business, within your leadership, within compliance, legal, right? Alpa: The whole 180 or 360 to make sure you have the right stakeholders and do have the right governance because most organizations I think are failing there as well for not having a strong governance and the proper escalation process. Alpa: And you know you go ahead go ahead. Yaffy: Oh I was just going to say look somebody made a comment about GRC platforms and I agree look a lot of folks that we work with have Archer Service Now or Koopa and a lot look again folks sometimes they choose to go with a best of breed sometimes they choose the modules right it depends on what they need. Yaffy: I I will say I don’t think that those guys Yaffy: uh the larger GRC’s were built purposefully for third party risk but if know sometimes people just need good enough and they have a module and that’s fine. Yaffy: I’d say you know most of the time that people really need to kind of roll up their sleeves they move towards and again I don’t necessarily mean us but something that’s more um you know purpose-built best of breed provider but when these systems work in collaboration Yaffy: I you get you get a lot of data a lot of useful data for good decision- making Alpa: no and I agree and I think like you said you know you’ve seen like said civian labs or lots of out there but I think again it’s one part right the technology is not going to solve your problem in a sense of it’s not investing just in the technology it’s understanding what is your risk appetite what are your controls right because you can invest as you know as I call you can spend millions and billions in the system but if you don’t have the right requirements and the scope and what you’re trying to get out of that system you’re going to fail right Yaffy: well to me that’s it it’s always about god I met this guy used to be for providence healthcare which was a Yaffy: uh you know it’s a big healthcare out in the Pacific Northwest and he he kind of schooled me on this very early and right risk appetite right what’s acceptable Yaffy: what’s not what are you going to accept what are you going to deny and what are you going to communicate up you’re like this is where we’re at here’s our risk we can choose to fund it Yaffy: right Yaffy: or we have to accept that there’s this risk to the business and then people have to evaluate the potential brand and financial and right sometimes it’s quantifiable sometimes it’s not but that That’s really important and communicating that as a third you’re like look we have major dependencies we don’t know if any of our vendors going back to the first question um are using Solar Winds we we’re not asking any questions that will help us further the conversation here so and you know bring up your other point right where you say that this is no longer tactical checkbox that’s why it’s strategic because it significantly as we learned from COVID impacts your supply chain I just summarized everything you said right there in like 30 seconds. Yaffy: So, Alpa: I love it. Yaffy: All good points. Yaffy: All awesome points. Yaffy: Amanda, let’s skip to the next one. Yaffy: Uh, skip this one. Yaffy: We already kind of covered this. Yaffy: Um, you know, this is interesting because most of the people that come to us are are have generally had a recent audit experience. Yaffy: So, uh, as you would imagine that that it’s when you know used to work in some of these other companies, hacks or breaches tend to get people’s attention. Yaffy: Here it’s audit findings. Yaffy: So why do programs fail? Yaffy: What are people looking for in audit? Yaffy: Um what why are they failing audits? Yaffy: And what are the auditors looking for? Alpa: Yeah, look I mean auditors are looking at specifically one is what is your universe looks like? Alpa: Right. Alpa: What is that? Alpa: Do you have a comprehensive list first of your vendors? Alpa: Then how are you defining them that are critical? Alpa: Do you have the right definition of defining critical? Alpa: And I will say in my, you know, last whatever decade, you know, you have very different answers. Alpa: Somebody’s like, well, because we spend XYZ, they’re considered critical. Alpa: And we’re like, okay, so for example, you’ve got a consultant and they’re just doing literally billing and you’re saying because we’re spending X amount, they should be somehow critical, right? Alpa: So, I think it’s one them really assessing what is your definition of critical. Alpa: Are you looking at like recovery time, objective, RTO? Alpa: Are you looking at what that disruption will have to the over impact to the business right so I think it’s one defining that list and understanding why it is in that list second is how are you measuring the risk what kind of processes where you’re saying this is highly risky high risk low risk moderate or nominal right and they need to have a very standard and a consistent method of measuring that risk and that’s why you see lot of audit failings or you know needs more more as called you know satis it’s unsatisfactory or needs more work and the reason why is because what they’re saying is you’re measuring risk on a different factors across different parts of the firm and that’s where that scale and standardization becomes extremely critical and then they look at your ongoing monitoring process right how are you ongoing monitoring what are you doing on the due diligence are you looking at certain domains are you asking for certain additional detailed documentations right um are you asking them for their processes, their procedures, what kind of controls do they have, uh if they fail, what is their backup? Alpa: And I’ll tell you a lot of the times audit and this has been, you know, in some of my previous organizations where we’ve had, you know, what’s your exiting strategy plan look like? Alpa: And to be honest, it’s very people think it’s very simple. Alpa: So, for example, it’s like if I’m using a cellular service Verizon, I’m just going to go to AT&T. Alpa: But if everybody moves from Verizon to AT&T, do they have the bandwidth to support you have you talked about your specific services and can they actually do those in those regions? Yaffy: If you detail Yaffy: if you ever watch John Oliver on HBO, John Oliver would not support you switching to AT&T. Alpa: Okay, great. Alpa: Well, I’m so sorry, John. Alpa: Um, that was just an example we’d love, but we’ll make sure I’m not going to any of the proponents. Alpa: I don’t I don’t have specific Yaffy: He has two things that he constantly rails. Yaffy: One he rails against, which is AT&T and Then um uh what’s his name? Yaffy: Adam Driver who he he loves. Yaffy: Sorry. Yaffy: Very much a non-scrator. Yaffy: But back to the Alpa: so maybe T-Mobile. Alpa: I don’t care. Alpa: Maybe Sprint. Alpa: I don’t know. Alpa: Whoever the other car is. Alpa: But what what you’re saying is your exiting strategy has to be accurate, right? Alpa: If you’re really going to think about plan B, have you had this communication with them? Alpa: Do they know that they would be the second as a second line of defense? Alpa: They understand that if there’s an issue, they will come and support and they understand your business model and strategy and a lot of the times they don’t have that. Alpa: So I think it’s making sure and then also your procedures right do you have updated procedures a lot of our procedures had to change because of co right so if audit comes in and we’re saying is everybody’s working from home what are your controls have you updated that clause in your policies and a lot of us have not done that right so I think it’s that and then contracts a lot of my contract says um you know we hired third fourth party vendors but we don’t really ask them where they’re located and what’s the concentration of those vendors. Alpa: So are they doing 80% of the services. Alpa: So we need to refine those things and audit is looking for them and to be honest a lot of them we don’t even have contracts. Alpa: Some of them are evergreen so we never go back and some are been outdated and expired and these are the things that the audit is looking for and that gives more visibility to regulators as well. Alpa: How you know how good is your shop? Yaffy: Right on. Yaffy: Uh next question and You know what? Yaffy: We’re going to come up to the 45 minutes. Yaffy: We’ll give people time for questions. Yaffy: If not, I always like to let Yaffy: end a few minutes early just to give people, you know, a chance. Yaffy: I know we all have a ton of Zoom calls right now. Yaffy: So, I I I love this one in that So, you’re running third party risk program. Yaffy: Let’s say you’re you’re you’re getting results. Yaffy: What are the metrics you report up to within the security team? Yaffy: What are the executive metrics? Yaffy: What are the board me and maybe they don’t go that far, but what are the metrics which is one and then the other one and we’ve heard this a lot from other from customers they’re struggling getting uh other lines of business involved or support or buy in to kind of working with them to to do this. Yaffy: So um I think these are the two kind of subjective things that people once they deploy third party risk or they they’ve have some kind of process repeatable in place I think they’re struggling with a little bit. Yaffy: So how would you solve both both of these things. Alpa: Yeah. Alpa: So look, I think reporting is extremely critical because that’s the only transparency you’re providing to leadership, right? Alpa: So the way that we are creating reports is and again depending on so we have weekly and monthly and quarterly reports but the once is the searity of that specific finding. Alpa: So if you have a finding such as access controls or you know the data privacy and the vendor is not coming back to you or showing you any as I call proof or justification how they manage that and let’s say it’s over 15 days days or over 30 days that is now creating a risk for that specific business. Alpa: So what we do is we have a report saying hey we had XYZ findings here’s the searity high moderate low and what is the timing that you know we within organization based on our risk appetite so if we say 7 days 15 day 30 days and then what is our next action do we then terminate the render because we’re not getting the right information on time and that’s putting us at risk and those are the reports we socialize within the leadership and like you said Now even the board wants these reports because they also want to understand who are these vendors and what could that be impact and are we okay with terminating these vendors. Alpa: A lot of them we use them on the business committee meetings or the new product development committees. Alpa: That’s where we have pretty much all the business leaders in there and that’s where we kind of bring out these findings and walk through the processes and then saying and some of them are honestly you know as a business like you said before they’re saying I’m okay to take this risk because I need this vendor and they will give me this otherwise I will not be able to put my new product in the market thus I’m willing to accept this risk and some they’re saying no we don’t feel comfortable with the mitigations that they have provided or the documentations or the reports um so either they’ll provide additional or we will not continue to do business um how do we get business involved um look I think more and more business takes accountability right third party governance I don’t know where they sit they could be sitting in operations they could be sitting in finance they could sit in compliance end of the day it’s business who’s making the decision and it’s business who takes accountability. Alpa: And one of the way we’ve started doing this and across and you’ll see it in the industry especially in the financial you actually have people embedded in business that look at third-party governance risk for that specific business and they have like a dotted line. Alpa: So they have a dotted line to the business and a dotted line to operations or the center of excellence. Alpa: And I think that’s a great way to get business involved because now the business one of the excuses but I need to focus on the revenue. Alpa: I don’t really care about the risk and that has to change and thus having people embedded in the business who has the expertise of the risk can start connecting the dots. Yaffy: Great. Yaffy: So with that, um, Amanda, I’m going to come back to you. Yaffy: I think we I was looking at the questions. Yaffy: I think we’ve covered them. Yaffy: So why don’t we go back to you if you have a poll or you got any more questions? Amanda: No other questions right now since you guys like took them live, which is awesome. Amanda: But I do have one more poll question that I’m going to pop in here, and it’s similar to the first one, but a bit more specific, and we’re just straight to the point since having this conversation with Alba and Mike. Amanda: Are you looking to augment or establish a third party risk management program in the coming months? Amanda: Do you guys have a budget you guys need to create for 2022? Amanda: Do you want to squeeze this in? Amanda: All that kind of stuff. Amanda: Um, yes, no, I’m not sure. Amanda: Be honest with these choices because I personally will be following up. Amanda: So, I want you to be aware it will be me. Yaffy: Oh, Amanda, now you’re selling. Yaffy: Like people are going to be like, “Nope, I don’t want to talk.” Yaffy: Be like, “Nope, nope.” Yaffy: Hey, Ala, while people are figuring out yes, no, maybe. Yaffy: I’m not sure whether they want to talk to Amanda or not. Yaffy: Um, Yaffy: can you put a bow on this for us? Alpa: Yeah. Alpa: Look, we’re gonna have more and more data. Alpa: Please protect your data, identify your data assets, and make sure have the right governance on it, leverage the technology, but at the same time understand the risk within those technologies because nothing is as I called the there’s no rainbows, there’s no unicorns. Alpa: So if you leverage technology, but make sure you have the right people looking and assessing the risk. Alpa: Um and you know make sure you have a right operational resiliency because none of this cyber attacks are going away by anytime soon. Alpa: Um you don’t you know reputational risk is extremely critical and more important. Alpa: So invest in it. Alpa: In the 10 years that I’ve seen organizations have been successful as they’ve funded had the right talent and the right technology. Alpa: Um they’ve kind of sort of passed through this co much more better than the others. Yaffy: Um thank you. Yaffy: And I would I would just add you I think you’re 100% right and and folks as you’re doing this go for smaller wins. Yaffy: Again don’t you know you you’re not going to start a program from scratch and and assess a thousand vendors. Yaffy: It’s a pipe dream like people Yaffy: You know, people are like, “Oh, or you know, I’m I’m going to do 250 my No, you’re not. Yaffy: Like, you’re going to get a program stood up. Yaffy: You’re going to get something implemented and you’re going to figure out how to assess effectively your first year or a percent of your vendors, right? Yaffy: And then you can you can stand it up. Yaffy: That’s a win. Yaffy: You can start assessing. Yaffy: That’s a win. Yaffy: You can get good data back. Yaffy: That’s a win.” Yaffy: And start making decisions and then grow it over time. Yaffy: The jumping in, you know, two feet into the pool is not a good idea. Yaffy: Like you you Right. Yaffy: Eat an elephant one by one. Alpa: It’s not sustainable, Mike. Alpa: It’s just not sustainable and it’s like you’re boiling an ocean, right? Alpa: And you’re not going to get anywhere to be honest. Alpa: So, we have I agree. Alpa: I think it’s small wins and be strategic, right? Alpa: Start with the small pool of vendors that you know are going to be critical to your services and then expand based on region, the risk, everything else. Alpa: But yeah, I completely agree with you there. Yaffy: Yep. Amanda: We have one more question. Amanda: Yaffy, if you wanted to read it out or me read it out, but I think you can close it all and end this. Amanda: Uh Yaffy: yeah, legal teams need to understand how evolving thirdparty risk may impact their contracting and possible litigation process. Yaffy: Um think of having information as centralized location so it can be easily reviewed allowing teams to identify areas and cost savings to consolidating process with your vendors while also reducing risk. Yaffy: Um all of these pieces should be communicated to help vendor management teams earn a seat at the table I guess. Yaffy: So It’s feels like more of a statement, Chris deferred, than a question. Yaffy: But I I don’t disagree with anything that you said. Amanda: There’s a question mark at the end. Amanda: That’s what threw me off. Yaffy: Yeah. Yaffy: But just putting a question mark does not make it a necessarily. Yaffy: It doesn’t. Yaffy: That’s what my wife tells me anyways. Yaffy: I’m like, Yaffy: hey guys, look, I’ll I’ll wrap it up here and call it. Yaffy: So everybody, Alpha, this was awesome. Yaffy: Thank you. Yaffy: I I think we got through a ton. Yaffy: There was a lot of really good information. Yaffy: We will definitely love to have you back and um you know do one of these as a as a drill down topic. Yaffy: So thank you very much. Alpa: Thank you so much. Alpa: Thank you Amanda. Amanda: Yeah absolutely. Amanda: And then one more thing I did put my um email in the chat for everyone if anyone had any other questions. Amanda: Please feel free to reach out for me directly. Amanda: So it’s in there. Amanda: It’s a prevalent.net. Amanda: Other than that, thank you everyone for your time. Amanda: We’ll see you at the next one and you’ll get this recording in a couple hours from now. Amanda: Okay. Yaffy: Wow. Yaffy: Bye. Alpa: Thank you. Alpa: Thanks.