Stratégies d'atténuation des risques de la chaîne d'approvisionnement dans les quatrième et neuvième parties

Melissa: My name is Melissa. I work here at Prevalent in Business Development. Melissa: And today we have a returning guest, CEO of Cyber Marathon Solutions and former CISO at Cityroup, Bob Wilkinson. Welcome back, Bob. Bob: Thanks, Melissa. Glad to be here. Melissa: Good. Melissa: Um, last we and certainly not least, we have Scott Lang. Melissa: He’s also with us. Melissa: Scott’s our VP of product marketing here, and he will dive in a little towards the end of the I don’t know the webinar to see how we may be able to mature your TPO. Melissa: TPRM program. Melissa: I think I say that about 52 times a day. Melissa: Um, so just stay stay with us towards the end if you don’t mind. Melissa: Um, and hello Scott. Scott: Hello Melissa. Melissa: A little bit of housekeeping. Melissa: The webinar is being recorded as you can see. Melissa: So you’ll get this and the slideshow shortly after the webinar. Melissa: And u you’re all muted lastly. Melissa: So just use that Q&A box for any of those questions you have during the webinar. Melissa: And without further ado, I will throw things over to you Bob. Melissa: Go ahead. Bob: Thanks Melissa and Everyone, if you have any questions as we go along, please feel free to submit those questions. Bob: We’ll address them as they come up and if there’s any remaining at the end, we’ll take them there. Bob: So today’s topic is mitigating supply chain risks in fourth to nth parties. Bob: So as we go as we go through the topics, uh we’re going to cover a number of different aspects of the fourth to party or what we sometimes call subcontractor relationships that we have in our supply chain parties programs. Bob: And one of the things that I that I did here is I’m talking about the supply chain because it really is more than just third parties. Bob: It extends throughout your organization and it’s becoming more and more important as time goes by that you understand the depth of the relationships and the number of parties that you have particular particularly around those activities uh which are considered critical business activities. Bob: So we’re going to talk about fourth parties. Bob: We’re going to talk about uh criticality and how it relates to your supply chains. Bob: Going to spend a little time because we are talking about fourth and and fifth etc parties about baseline security standards and how just complying with those is often not enough to ensure that you’ve adequately protected yourself and why you might still remain a target and then what you might do about that. Bob: Why it’s important that uh you have full visibility into your extended supply chain. Bob: Techniques for determining what your full supply chain actually looks like. Bob: The importance of the onboarding process. process in understanding and minimizing risk to your businesses and your critical business processes. Bob: Then we’ll talk a little bit about some of the event triggers that might occur that might necessitate reassessing your supply chain relationships. Bob: We’ll talk about the key role of automation and how if you’re not automating your third party risk program today, your supply chain risk program program, how you’re really at a disadvantage and it’s going to be very hard to achieve your goals. Bob: Then we’ll talk a little bit about key performance indicators, key risk indicators, and how to use them in measuring your overall supply chain risk. Bob: What kind of things might we need to report um about our program and our extended supply chain and to whom and at what level? Bob: And then talk some more about the supply chain community and what we might do. to enhance the relationships there. Bob: So why should we focus on fourth to end parties? Bob: Well, part of the reality here is that when you look at where security incidents actually occur, you find out that it’s it’s pretty common that the majority of security incidents that you have in your program can be tied back back to your third parties. Bob: But when you look past that, what you realize is that a lot of these incidents actually start with your fourth, fifth, and sixth parties. Bob: So being able to prevent security incidents and being able to preserve the operational resilience of your critical business functions, it becomes really important to understand what steps you’re taking to understand what your full supply chain looks like and how it’s protected. Bob: So here I have some examples of some of the challenges that we’ve come up with which really get to the fourth to through nth party risks that you face. Bob: So if you’re in any manufacturing industry in the US for example and you expect suppliers from around the world to provide you with products well there’s been several instances now where there have been blockages in Suez Canal. Bob: So thinking about what can possibly go wrong. Bob: Well, you know, the transit of goods and logistics is an important factor that you need to consider. Bob: You also have to consider the fact that there have been multiple strikes against particularly on the west coast in both the US and Canada. Bob: Strikes which have resulted in delays and offloading cargo and getting that to businesses many of whom rely on just in time. inventories. Bob: On the software side, we’ve seen Solar Winds, Log 4J, and most recently the Move It uh vulnerability that was exploited and has hit a large number of companies. Bob: So, understanding who the suppliers are from a software perspective both to your company and to your third, fourth, and nth parties. becomes an important aspect of how you manage risk. Bob: When you have a security incident, one of the first things that happens is you have to identify uh whether any of your lines of business, any of your critical business processes have been affected by a vulnerability that’s announced. Bob: And that’s sometimes a challenge just within your own organization. Bob: But then you have to look at your critical business processes and understand when whether any of your third, fourth or nth parties is also using that software that’s affected. Bob: I’m going to talk a lot more about software as we go forward because I see that as one of the primary risks that we face in supply chain risk management these days and it’s clearly a target of all the bad actors who would seek to interrupt our businesses. Bob: Back in COVID, uh, there was a a subcontractor who was manufacturing key components for vaccines, uh, emergent biosutions. Bob: And in the process of doing that, they mixed up the vaccines between two different organizations that they were manufacturing for at a critical point in the COVID epidemic. Bob: And what happened was millions of vials of vaccine had to be destroyed at a time when it was critically needed. Bob: And then finally, the and and today is a perfect example with the category 4 hurricane hitting Florida, the accelerating climate change events and the impact that they have on our supply chains. Bob: So understanding where we are critically dependent either on products or services being delivered and how those areas where those services and products are actually being delivered are affected by adverse changes in the weather is becoming an increasingly important factor in ensuring our operational resilience. Bob: So the net net of this is that things that we may have re regarded as black swan events in the past have become all too common today and that represents a significant risk. to our businesses. Bob: So given that our programs for supply chain risk today um that we have so many third parties that we have to focus on and then when we look at it from a an extended supply chain perspective, you know, how does the number of fourth, fifth and nth parties actually impact how many supplier relationships we need to cover. Bob: So if we have 100 third parties, does that mean we have 200 fourth, fifth and sixth parties? Bob: And how can we possibly manage all of that? Bob: So at some point we have to decide where to focus our scarce resources to give us the best protection that we can get. Bob: And that’s where understanding the criticality of our business processes comes into play. Bob: And if you are starting out in your program and you haven’t yet identified what your critical business processes are. Bob: One thing that you can do is you can certainly work with the group within your organization that’s responsible for business continuity and preserving critical services as a starting point to get your arm arms around it. Bob: But once you understand which your critical business processes are, what you have to do then is You need to understand that full extended supply chain because if you make sure your third parties are okay but you haven’t checked your fourth and fifth parties and they’re providing a critical component of that critical business service then you’re vulnerable and it’s absolutely essential in this environment that you understand the risks through that extended supply chain. Bob: So when you’re thinking about criticality think about the your most important business processes. Bob: Think about where your sensitive information is actually residing in the supply chain. Bob: So, which of your suppliers actually have access to your sensitive data? Bob: Because just because you share it with a third party doesn’t mean that they’re not sharing it with a fourth or fifth party. Bob: And if you don’t ask the question, you might not fully appreciate how vulnerable your organization sensitive data is to compromise an attack. Bob: The other aspect of that is that sometimes we grant access to our third parties to allow them to have access to our infrastructure and from there sometimes those third parties share that access to our infrastructure with fourth and fifth parties and they might not even inform us. Bob: They might share user ids and passwords and in the case where that occurs that represents a significant risk to your overall business processes and how resilient they are. Bob: The one caveat I’ll give you with that is while you think about what are critical services, what you think might not be critical today over time can in fact become very important to your organization. Bob: And I’ll give you uh a quick example of that. Bob: Back when I started uh one of my first risk uh thirdparty risk programs, I was dealing with an organization where there were 10,000 suppliers. Bob: And one of the things that I had to do was decide where we were going to focus our efforts. Bob: And we identified our critical business processes. Bob: But one of the things that we excluded, and this is going back 20 years, was law firms because we didn’t, you know, did not see the risk with um law firms at the time. Bob: Well, fast forward to today and law firms are one of the major points of attack and compromise that we’re seeing in the supply chain because it turns out law firms are instrumental in the M&A process that many organizations go through. Bob: So, they often know about deals before they happen. Bob: And likewise, when companies have to settle lawsuits that involve consumers, companies often rely on law firms to help them with whatever settlement agreement occurs, which means they have access to vast troves of customer confidential information, which can then become a target. Bob: So what’s not critical today may be critical at some point in the future. Bob: So we should never be so fi fixed in our ways that we decide just because it isn’t critical today, it might not be critical tomorrow. Bob: So revisiting those decisions periodically is an important aspect. Bob: So on to baseline security standards. Bob: So there are certain standards and this is only a partial list. Bob: It’s not meant to be exhaustive. Bob: Um there are certain key security and operational risk standards that we make reliance on. Bob: The three lines of defense model where you have the resources within the organization who actually execute things and then you have independent oversight at two levels. Bob: Uh one may be through an enterprise or operational risk management group and then through your independent audit function. Bob: Then if you who work in supply chain risk particularly in the financial services industry but it’s relevant for all then you closely follow the federal information security uh guidelines that the various regulators have propagated and fortunately there the what’s called the FFIC which constitutes all the major regulators in the US for for financial services have agreed on a common standard which was recently published this year. Bob: You need to understand what those min minimal security standards are. Bob: And then finally when uh organizations look at their overall security and operational resilience they often focus on the cyber security framework developed by the the national standard of national institute of standards and technology. Bob: So They provide us with the baseline security that we build into our supply chain risk programs. Bob: But the difference between us and protecting our organizations and the bad actors who would act against us is that those bad actors know the baseline standards as well as we do. Bob: And they know where it starts and they know where it stops. Bob: And the difference between the bad actors that uh we have to face off against and ourselves is that we have limited time and limited resources to protect ourselves. Bob: So we put most of our efforts into complying with these baseline security standards which we absolutely need to do. Bob: Let me be clear. Bob: But the other side of the equation is that bad actors for all intents and purposes have unlimited time and unlimited access. Bob: And they certainly know where these baseline security standards start and end. Bob: And it’s really by and large with third parties. Bob: So they focus their efforts on compromising those fourth through nth parties. Bob: And that’s really the point that I’m trying to make here. Bob: Understand your critical processes and understand your extended supply. supply chains because if you don’t, I can assure you that the bad actors do and that they will take advantage of that through attacks on third party software, um, all of the ransomware attacks that we’ve seen, social engineering, and when it comes to those subcontractors, contractually, we’re supposed to hold the third parties liable for anything that happens on any subcontractors that they may use. Bob: But in practice they may not do a very effective job at that and in the process that leaves your organization vulnerable. Bob: So when I think about risk and and criticality and how to define where I want to focus my efforts, I think about understanding where it is that my sensitive information resides and who it is that has access to my infrastructure where that information resides. Bob: So having made this statement that baseline security standards aren’t enough. Bob: What can we do about it to improve our security? Bob: So when I think about that problem, what I think about is differentiated security solutions. Bob: So how can I make my organization differentiated so that when a bad actor looks to exploit my a supply chain to attack my organization, whatever their end goal may be. Bob: If I do something different that they don’t normally see when they try to exploit an organization, the odds are very high that they’re just going to move on to their next target. Bob: So, by doing something that differentiates and is in addition to the basine security standards, there’s a much higher probability that your organization is not going to be subject to a security event that leads to an incident than if you just follow the bare minimum security guidelines that you need to follow. Bob: So what kind of things can you do to differentiate? Bob: Well, you can extend your efforts around understanding your inventory to really understand who those fourth and if parties are that are part of your critical business processes. Bob: Another aspect of this problem is know what I refer to as know your supply chain. Bob: And what I mean by that is that I have seen numerous situations both internally and externally where madeup vendors that don’t really exist, madeup suppliers, um people internal in the organization are making payments to those suppliers and those suppliers are fictitious. Bob: And I’ve seen it go on for years and cost organizations millions of dollars. Bob: So there’s very good reason to say, well, if you have a list of suppliers, are they real suppliers? Bob: Because increasingly we’re seeing fraudulent suppliers that aren’t really delivering anything, but our organizations are making payment to them. Bob: One of the key things, the absolute key things for me in limiting ongoing risk within a supply chain risk management program is continuous monitoring. Bob: Continuous monitoring is essential to being resilient as we move forward. Bob: Doing a periodic risk assessment has its role and it and it’s certainly a valuable exercise when you’re starting out in a new relationship with a supplier, but it’s only good on the day that it completes and that at that point you have some understanding of your risk. Bob: The other 364 days a year you’re vulnerable. Bob: You don’t know what’s happening. Bob: Every day we see zero day vulnerabilities come out. Bob: We see new attacks. Bob: We see new compromises. Bob: And if you’re not continuously monitoring your supply chain for your critical business processes, then you’re at a real disadvantage. Bob: Uh in today’s environment where we need to be constantly vigilant. Bob: And then another thing that you can do is streamlining your onboarding process. Bob: And what I what I’m getting at here is understanding that when your business comes to you and your business says, I want to onboard a new supplier. Bob: If you set up your database, your inventory of who your suppliers are, and the services that they’re actually providing. Bob: You may have already onboarded a supplier who can provide that service to your business unit and not have to onboard yet another supplier. Bob: For me, the biggest risk with supply chain risk management is the unending stream of new third parties, new fourth parties that we’re asked to onboard when we already have one that’s providing that service. Bob: So, The net result of that if you continually onboard and you never challenge the business to say we already have a supplier who does it. Bob: It takes a lot of time, effort and money. Bob: And when we look at the rate of growth of onboarding of new suppliers, that can be up to and beyond 10% a year in terms of the number of suppliers in your supply chain risk management program. Bob: That’s an enormous amount of work for everybody to do and you’re not necessarily getting any additional budget to do it. Bob: The other point is that by just accepting the onboarding of new suppliers, you’re you’re vastly expanding your risk exposure because with those new supplier relationships, there’s going to be additional access to your infrastructure. Bob: There’s going to be additional access to your sensitive information and your overall risk profile from a supply chain perspective is going to go up. Bob: So by understanding the inventory of suppliers that you already have, what they do for you, you can eliminate requests to onboard duplicative suppliers and mitigate both the cost of your program and the risk that you’re exposing your organization to. Bob: So, shifting gears a little bit inventory that you’re working with. Bob: You have to understand the full supply chain, where your information resides, who has access to what, if you’re going to properly manage the risk that you’re exposing. yourself to. Bob: One of the biggest problems that uh organizations run into is that they don’t have a good way to get visibility into the who their subcontractors are. Bob: You may ask your third parties to disclose them and sometimes they do. Bob: I think that it needs to be contractually disposed disclosed so that whenever you’re entering a new relationship with a third party that they close all fourth, fifth, and nth parties that are performing any service as part of their relationship with you. Bob: And for your existing inventory that you go back on an annual basis and ask them if there’s been any change in any of the suppliers that are are helpful in providing a critical business service to you. Bob: And that increasingly we need to deal with the reality of all the compromises that we’re seeing with third and fourth party software. Bob: So, we build an inventory of who our third parties are, ideally our fourth and fifth parties, and we think we’re complete, but we’re not complete unless we understand all the software, all the third party software that’s running both in our organization and for our critical business processes. Bob: The software that’s being being used at our extended supply chain because when an incident happens with a particular software like move it, it’s not just a question of whether your organization uses move it but for any of your critical business processes where any of the suppliers in that supply chain using move it as well. Bob: So we really need to have that deeper understanding of how it all comes comes together. Bob: Now, part of the uh the challenge and I’ll I’ll I’ll give you a few illustrative examples is one situation that I was involved with involved a bank ATM network and that ATM network. Bob: The servicing of the ATMs was outsourced to a third party. Bob: The third party hired a fourth party to actually do the maintenance of the ATMs. Bob: So that um because the third party did not have the capability in that particular region to do it. Bob: It turned out that the fourth party was in fact an or organized criminal group who besides servicing the ATMs per the contract were regularly swapping out the hard drives of the ATMs to get gather the information that was collected about all of the customers using those ATMs and using it to manufacture co cards and fraudulently access those accounts. Bob: So if you don’t do your due diligence around the fourth party then you may be completely unaware of who it is that the third party has hired and the the resulting compromise that can occur. Bob: Another example was in in another region the mortgage payment process. Bob: They would actually have collections people show up at the physical location where the mortgage uh the mortgaged home ex existed and ask the owners to make payments to them and then bring those deposits back to the office. Bob: Well, one of those mortgage collectors was uh terminated. Bob: Yet, they continued to collect the mortgage payments and So after several years of this ongoing and $3 million in losses, they discovered that that subcontractor who would go around and collect the mortgage payments no longer work for the company. Bob: So there are numerous examples like this where failure to do due diligence on fourth parties leads to problems. Bob: Okay. Bob: Supply chain inventory The typical way that organizations build their inventory is they ask their different internal stakeholders within their various lines of businesses. Bob: Who are the third parties that you’re using? Bob: And usually that’s as far as the question goes. Bob: There’s no contemplation of well are the third parties actually using any fourth or fifth parties to deliver the service that’s required. Bob: And if that question is isn’t being asked, then you’re not even aware that there are any fourth, fifth, etc. relationships. Bob: So, that’s problematic in itself. Bob: But another way to get at this question when you’re trying to build an inventory and make sure your inventory is complete is to go to your accounts payable department and ask accounts payable for a list of all suppliers that were paid in the last two years. Bob: And that will help you understand that at least you’ve identified all of the third parties that are key to your relationship. Bob: Now the extension of that is to go to your third parties and say are you paying anyone else to deliver that service for my company and if so who are they and I need to understand that and again with this you need to go back periodically. Bob: So just asking one time isn’t enough. Bob: The inventory of suppliers that our third parties work with is constantly changing. Bob: The relationship is changing. Bob: Information sharing is changing. Bob: So you have to in your process go back and periodically ask about changes not just with your third parties but fourth and fifth parties as well. Bob: Now one of the things that you can do to get at this problem to help yourself out is using automated discovery techniques. Bob: There are various products and tools that are now available which will help you discover business relationships with companies that can help identify fourth and fifth parties that your third parties might be using. Bob: Automation is a key factor here in the success of supply chain risk management. programs and leveraging some of the automated tools that exist out there to help you understand the extent of the full supply chain relationships that your third parties may be having in place to deliver a service to you is absolutely critical. Bob: Onboarding the supply chain onboarding process is a key control point. Bob: for how you manage risk in your supply chain program. Bob: Starting off, and I’ve already mentioned this, starting off at the beginning, the first question that you need to ask whenever you’re looking at onboarding a new third party is, do I already have a third party that provides this service? Bob: And if you do, have that conversation upfront with your business to say, we’ve already done due diligence. Bob: We already have a third party that provides this service. Bob: Let’s leverage what we have instead of adding yet another third party uh that we have to be responsible for and that we’re exposing our data, our infrastructure to. Bob: So, whenever you get a request to do due diligence on a new third party, the first thing that I always do is go back and say, “Do we already have a third party that does that?” Bob: Because if we already have a third party that does it, we already have a risk assessment that’s been performed. Bob: If we’re doing continuous monitoring, we can turn around and leverage that and expand it as necessary in an existing relationship. Bob: So for me, the best way to limit third, fourth, and nth party risk is not letting new third parties get get on boarded in the first place. Bob: And if we can do that effectively, then that is the most effective risk mitigation strategy that we have in place. Bob: Work with what we have instead of just endlessly expanding that. Bob: And on another note, another aspect of this is with mergers and acquisitions. Bob: Whenever your organization may make an acquisition of a new company, you’re not just getting that new company you’re inheriting all of the third, fourth, and nth parties that they used. Bob: Do you need those relationships? Bob: And if you don’t need those relationships over time, those relationships can be consolidated and that will decrease risk in a very meaningful way for your organization. Bob: Event triggers for supply chain reassessment. Bob: There are certain circumstances where you’ll want to go back and you’ll want to reassess the risk that exists because you had an event occur which suggests that uh there may be problems in the supply chain relationship. Bob: Obviously, a data breach is one of those circumstances. Bob: Changes in ownership, whether someone buys one of your suppliers or whether they’re subject to a merger or acquisition. Bob: When However that occurs, there may be significant changes made within the organization and there may be significant changes made in any fourth through nth supplier relationship that exists. Bob: Whenever new regulations are propagated, you have to make sure that you understand the full impact of new regulations in those industries where you’re subject to them and that not just your third parties but fourth through length parties are also compliant. Bob: Moving data centers to new physical locations, you know, whether it’s offshore or migrating applications and infrastructure to the cloud, those are all reasons why you need to from a supply chain perspective understand the additional risk. Bob: So if you have applications that are migrating to the cloud, which is very common these days, well, you know, who’s your cloud partner? Bob: And what do you know about where the web hosting is actually occurring? Bob: Those are important questions in ensuring your operational resilience. Bob: Expansion of the supplier relationship. Bob: Many times where we find problems, a business unit will make a decision to perform a pilot with a third party and it’ll be a very limited pilot. Bob: But then a business the business makes a decision to expand it and have a full-blown implementation that you may not be aware of or informed and that that supplier in order to meet your business’s need takes on a fourth or fifth party and you have no visibility into it. Bob: That’s why it’s important on a periodic basis to go back and check all of your relationships. Bob: Make sure that they haven’t changed or expanded in ways that when you did your initial due dill on the supplier uh that now you’re in a position where you may suffer a greater impact if a compromise occurs. Bob: Of course, you just like you want to understand your third party’s financial perspective and and are are they financially healthy, you have to ask your third parties about those suppliers further down in the supply chain to understand that they are also healthy financially. Bob: Otherwise, you run a risk of of interruption to key business processes. Bob: Automation in uh supply chain risk management program given where we are today and the expanded view of risk that we face. Bob: Automation is absolutely key to managing risk and it’s not just cyber risk which gets a disproportionate amount of the attention you know Operational resilience and business continuity are critical. Bob: Financial risk, operational risk, geographic and concentration risk and increasingly environmental, social and governance risks are important risks that you need to address not just for your third parties but also for your fourth parties and and fifth parties. Bob: So if there is for example an environmental problem at one of your subcontractors, your fourth or fifth parties, and they are part of a critical business process that supplies you with uh a given product or service, you’re going to be tainted by the results of that environmental problem at that fourth or fifth party. Bob: In fact, you may be uh legally liable for their fail. failure to comi to to comply with uh environmental regulation. Bob: So you really need to take a much more holistic view of the space and the only way you can manage that particularly when dealing with a large number of suppliers is if you automate your program and that is absolutely a key factor in your ongoing success. Bob: So what I’ve done here is I’ve provided you a checklist that would be helpful when you think about supply chain automation and how to ensure that your program has a comprehensive view of things. Bob: Have you automated your supply chain inventory? Bob: If you’re working off Excel spreadsheets, that’s problematic in and of itself at this point. Bob: Um, the do all of the business units within your organization use a common process for onboarding? uh new suppliers or are there different processes throughout your organization? Bob: You need to consider these things. Bob: Um do you have a centralized supplier contracts management database and so on and so forth. Bob: There are a number of other topics that you that that are covered here that I think are absolutely important to think about from an automation perspective. Bob: Not least of which is continuous monitoring, but also how it is that you manage the issues that are identified within your program because issue mitigation in a in a supply chain risk management program is the key activity. Bob: Everything we do is designed to mitigate risk. Bob: And if we identify issues and we don’t resolve those issues, we are not doing third-party risk management. Bob: We are doing third-party compliance management. Bob: And that’s not what we need to do. do if we’re going to adequately protect our organization. Bob: Key performance indicators, key risk indicators. Bob: The reason I have that here is it’s important that we whenever we think about collecting KPIs or KIS that we think about them in the context of whether they are providing actionable data. Bob: So they have to answer answer one simple question. Bob: So what what story is that key performance indicator or that key risk indicator uh telling us? Bob: What what what are the trends? Bob: Are we getting better or are we getting worse? Bob: And if they’re not answering that question, then we shouldn’t be collecting them. Bob: And KPIs and KRIS become important when we look at uh program dashboards and reporting and how it is that we’re reporting up on the progress of our supply chain. risk management program at all levels of management up through the board of directors and through any relevant regulatory relationships that we we might have. Bob: So some of the topics that you might focus on here is for example growth in the overall use of suppliers and that includes fourth through nth parties if we’re trending up significantly year-over-year. Bob: Why is that? Bob: Because that represents greater risk to the organization. Bob: Um how complete is our extended supply chain inventory. Bob: Do we really have full visibility into it? Bob: Are the number of issues among our suppliers in our extended supply chain going up or down? Bob: Are we getting better or are we getting worse? Bob: And then how is it that we’re accounting for regul regulatory information? Bob: For example, in banking, the the bank regulators, they perform regular assessments of suppliers. Bob: They consider are critical to the health of the financial services industry. Bob: And when they identify gaps in their risk assessments of suppliers, they share that with any financial organization that might be using those suppliers and the regulators expect you to take that information, report the gaps to your board along with your action plan. Bob: So there are consequences and you need to understand that. Bob: Finally, um there’s the supply chain community itself. Bob: Now, if you take the view with your suppliers that uh they’re just providing a service and that’s where the value ad ends, you miss out on a very big opportunity. Bob: Your suppliers are your partners and that includes your fourth through nth parties. Bob: And if you de develop those relationships and relationships are built one at a time and you establish trust, you will get much more out of your relationships with your suppliers than just treating them as if, okay, I’m paying you for a service and beyond that, I have no no need for you. Bob: By building those relationships of trust and building a sense of community with your suppliers throughout your full supply chain, you will realize mutual benefits. Bob: You will have enhanced relationship and you’ll have your suppliers reaching out to you when there’s a problem instead of you having to find out in the news about it. Bob: So, with that, uh, that ends my presentation. Bob: Um, thank you for your time. Bob: And if you have any questions going forward after this, if if some things occur to you later or you’d like to discuss any of those things, there’s my contact information. Bob: Anybody who reaches out, I’m happy to have a conversation with and see how we might be able to help out and uh and help you solve whatever problems or questions you have. Bob: Melissa, Melissa: thank you so much. Melissa: I’m going to go ahead and throw it over to Scott. Melissa: Scott, do you want to share your screen? Scott: I do indeed. Scott: Thank you. Scott: Uh Melissa, okay, terrific. Scott: Just a quick check. Scott: Can you see my screen? Scott: Okay. Melissa: Yep. Bob: Yes, sir. Scott: Awesome. Scott: Awesome. Scott: Well, guys, I just wanted to build off of uh what Bob talked about uh during his part of the presentation about uh you know the criticality of understanding your extended supplier ecosystem specifically and just discuss a couple of ways that preppling could help uh accomplish that. Scott: You know at the end of the day what we’re trying to help you achieve with your TPRM program whether it’s focused on you know fourth and nth parties or others or just kind of getting your own third party house your you know one one uh one concentric circle from your organization uh removed under control is three things. Scott: Number one One is get the data you need to make better decisions. Scott: A lot of what we find in organizations is that you know third party risk is accomplished through a couple of different uh intersections of people, process and technology. Scott: Bunch of different departments using some different disjointed tools very rarely talking to one another on a process or people perspective. Scott: Our objective is to help you centralize systems uh data and processes to help you get the most out of your TPM program and make the best decision on supplier onboarding uh supplier management and ongoing thirdparty uh third-party risk. Scott: Second, and this kind of drafts off that first goal is to increase your team’s efficiency and break down the silos silos between teams but also the efficiency of your team in executing thirdparty assessments. Scott: You know, we take away a lot of the additional cost and licensing and whatnot that’s required typically to conduct a full risk assessment. Scott: You know, we combine native assessments with continuous monitoring capability across cyber, business, financial, reputational, compliance, and other uh risk domain areas. Scott: And then we pre-integrated that into the platform to help you kind of see one holistic view of of of your third party. Scott: And then third, evolve and scale your program over time. Scott: You know, it’s hard to keep up uh with the comingings and goings of suppliers. Scott: If you’re in the procurement organization, you feel that acutely. Scott: If you’re in the security organization, you’re the one executing the uh cyber security risk assessments or getting ISO uh S SOAS or SOCK 2 reports and more. Scott: Uh And you know it’s hard to do more with the resources you have and the processes you have in place. Scott: So we can help you design an effective program that’s agile and helps keep up with uh you know the changing requirements in the market. Scott: You know our view of thirdparty risk isn’t just about sending out an assessment getting a a response d uh determining whether or not it’s a a risk and then applying some remediation and then kind of moving on. Scott: You know we we see risk excuse me as um distinct at every stage. a relationship life cycle you have with a third-party vendor or supplier. Scott: You know, sourcing and selection presents its own set of unique risks. Scott: Man, wouldn’t it be great if we had one place to view um a potential supplers’s you know, security certification and financial recent financial performance and um uh you know compliance status or um you know any sanctions against them, you know, whatever that could lead to some sort of disruption down the line. Scott: Like I said, what we’ve done is we’ve kind of pre-integrated that capability for you so you don’t have to a bunch of different tools and try and stitch them together on your own. Scott: You now have one complete view of that of that uh supplier that third party vendors throughout the life cycle. Scott: That’s with one use case. Scott: Uh from an intake and onboarding perspective, our objective is to get everybody onto one set of processes for intaking vendors uh for onboarding them for contracting them and then moving to a more comprehensive inherent risk assessment which then dictates ongoing regular due diligence. Scott: Uh and then in our platform we house uh more than 200 questionnaire templates against industry regulations, security frameworks, and others to help you assess your thirdparty vendors and suppliers against the requirements you you really have to focus on. Scott: And then it’s all about monitoring and validation of those controls and those findings on an ongoing basis. Scott: And as I mentioned before, we’ve kind of already integrated that capability into the platform so you can see it holistically. Scott: Uh next up is measuring SLAs and performance. Scott: And that uh as we know um you know a risk isn’t necessarily a breach, isn’t necessarily just a uh, you know, a negative audit finding. Scott: It’s also whether or not that supplier is meeting their agreed upon contractual SLAs’s. Scott: And because we have built-in contract uh contract management capabilities, we can help you extract those KPIs and KIS from the contract, automatically load them in the platform, assign tasks and owners for management throughout the relationship, and then when it comes time to to to break off that that relationship, terminate it, you know, we deliver an on offboarding checklist rather, that helps you make sure or that you know the data that you have the systems uh that your third party is accessing is appropriately turned off uh returned and destroyed uh accordingly. Scott: Um uh you know at the like like I said at the end of the day our three tasks are number one to help you simplify and speed up the process of of onboarding new vendors with a single source of the truth. Scott: Second to streamline the process and close gaps in risk coverage that might have happened as a result of silos or different people in processes. is involved and then finally unify those teams uh at every stage of the life cycle. Scott: You know, we address dozens upon dozens of different risk areas in the prevalent platform. Scott: I mentioned we have 200 questionnaires. Scott: This is just a s a sample of six buckets of a risk types that you can measure and manage with the with the prevalent platform. Scott: Uh what we ultimately deliver to you is a combination of people, data and platform. Scott: And that is you know the expertise that we deliver if you choose to outsource their party risk to our managed services team. Scott: We do the hard work for you. Scott: Onboarding, assessment, analysis, remediation, ongoing management. Scott: We incorporate the largest amount and number of data sources available into our platform to help add rich context to your decision-m and then finally house it all in one platform that that includes the workflow, the reporting, and the management to improve your program uh over time. Scott: And again, our outcomes for you are to help you know help your organization be smarter in terms of how it approaches third party risk. Scott: Be very data driven in our analytics, deliver role-based reporting to the people who need uh need information internal and external stakeholders. Scott: Unify processes, get to a single source of the truth from onboarding to offboarding, and then be very prescriptive about the steps you take to reduce risk down to an acceptable level, you know, in your organization. Scott: So, Melissa, that’s all I really wanted to share with you uh and the team here on um you know, what our approach to third-party risk is. Scott: I’m happy to kind of open up now to uh to questions, I guess. Melissa: Yeah, perfect. Melissa: Um, you know, thank you, Scott. Melissa: And if you do have a question, just drop those in the Q&A. Melissa: I know we have a couple. Melissa: Um, I’m going to launch our second poll real quick. Melissa: So, you’ll see that pop up on your screen. Melissa: Um, you know, so we can follow up with you regarding any TPR and projects on your radar. Melissa: You know, I’m curious to see if you’re looking to establish or augment something within this year. Melissa: I know people are securing budgets for 2024 already. Melissa: Um, maybe you’re stuck in spreadsheet jail and And as I mentioned, please be honest because we really do follow up with you. Melissa: And let’s check out these questions real quick. Melissa: I’ll do the long one first since we have like 5 minutes. Melissa: Um, all right. Melissa: So, Bob, what are best practices for handling situations when our third parties refuse to disclose the fourth or nth parties they’re using to support your organization? Melissa: For example, claiming that info is confidential even when there is an NDA between your organization and the third party. Bob: I think that’s that’s really an anomalous case. Bob: There should be no reason why a third party was unwilling to disclose that information. Bob: And off the top of my head, I see a bunch of potential issues with that. Bob: If you work in financial services and you’re going to be sharing some of your customer data, for example, with that third party and that third party is going to turn around and share it with a fourth party. Bob: That’s a very problematic relationship. Bob: So I know that uh this does happen and that people are reluctant to share the relationships they have. Bob: But first of all, there’s a contractual way to compel them to do that. Bob: But if they don’t want to share the relationships that they have with fourth parties, that raises a whole question about why you’d even want be doing business with them. Bob: So, you know, when I when I hear that those kind of stories, it makes me question what the value of the business relationship is and why I would even want to be involved in that. Bob: So, the other thing that you can do if if you need to work with them is using some of the automation tools that are available to help understand who the rel business relationships are that your third party is working with. Bob: But I just have a general sense of discomfort working with anybody who won’t even be forthcoming on that level of information. Melissa: Somebody added, “We have the opposite problem. Melissa: We have a vendor that will share fourth party information but not their own.” Melissa: So, just a little Bob: Well, uh that’s uh that’s not a good situation. Bob: I mean, one of the things that I always do with uh when when looking at a third party. Bob: The first thing I ask is, do you have an independent risk assessment that’s been completed in the last 12 months that you could share with me? Bob: That way, I don’t need you don’t need to share anything with me. Bob: If you have a risk assessment that was done by an independent third party at some point and that covers my business relationship, then it’s in all likelihood I’m going to get everything I need out of that independent risk assessment. Bob: I know lots of organizations, they do have an independent risk assessment performed and they use that risk assessment to share with new companies that they might enter into a business relationship with. Melissa: All right, I think we have time for one more question. Melissa: Um, changing gears here. Melissa: What’s the best way to visualize the supply chain slash parties? Melissa: More of a tangled web of relationships instead of a linear view. Bob: Um, It really is a tangled web of relationships. Bob: And in fact, some of the um suppliers for software that would identify fourth and fifth party relationships, they actually in some context refer to it as their spiderweb of relationships. Bob: So I would think that uh a spider’s web is a good way to think about it. Bob: And remember what’s important here is where is the service being provided from? Bob: It’s not that they’re just using a third fourth or fifth party, but where is that service being delivered from? Bob: And do they have access to your infrastructure? Bob: And do they have access to your sensitive information? Bob: Those should be the things that guide people. Melissa: All right. Melissa: And I lied. Melissa: We do have time for one more. Melissa: Um, what’s the best way to get a feel for your vendor’s vendor management process? Bob: Ask them how they do it Bob: and then come compare it to what you do and and you might learn something or you might find out they don’t really have one, in which case, do you really want to do business with them? Bob: They have to understand that if they’re going to share your information with a fourth or fifth party, first of all, contractually, you’ve obligated them to ensure that their fourth and fifth parties handle it the same way that they do and they’ve signed off on that contract. Bob: You know, that’s creates liability for them. Bob: They have a vested interest in ensuring that they’re doing something and the failure to do anything or the failure to disclose suggests an inherent weakness where if you’re sharing your sensitive information, I’d think about twice twice about before entering into that relationship. Melissa: Perfect. Melissa: Um I think that pretty much puts us at the top of the hour. Melissa: Um I know Bob was kind enough to share his email with you and it will be in the follow-up um you know email that we send out. Melissa: So thank you of course for coming back and of course Scott and you know thanks everybody for your questions and you know if you want to stay in the TPRM loop just add us on LinkedIn so you can see what kind of speaks to you the most and lastly I hope to see you know a good chunk of you guys in your inboxes and maybe even at a future webinar. Melissa: So thank you guys. Melissa: Take care. Bob: Take care. Scott: Bye.