高效供应商入职的 5 项策略

Melissa: Hello and welcome. Uh it’s great to see everyone start joining this morning or afternoon wherever you are. Melissa: Um I’ll give you a minute while we wait for people to get situated and connected. Melissa: And in the meantime, I’m going to launch our first poll because I’m always excited to see, you know, what’s bringing you here today. Melissa: Um is it educational? Melissa: Are you in the beginning stages of your TPRM program? Melissa: Maybe a current prevalent customer. Melissa: Let me know. Melissa: And in the meantime, I’m going to go ahead and get some intro started. Melissa: My name is Melissa. Melissa: I work here at Prevalent Business Development and today we are joined by a returning guest, Brian Littlefare, who is the past global CISO of Vodafone Group and Aviva. Melissa: Welcome back, Brian. Brian: Great to be here. Brian: Thank you for the invite. Melissa: Good. Melissa: Um, didn’t scare you off yet. Melissa: So, that’s great. Melissa: And last but not least, we do have Scott Lang, our very own VP of product marketing. Melissa: Hi, Scott. Scott: Hey, Melissa. Melissa: Um, as a little bit of housekeeping, this webinar is being recorded. Melissa: So, you’ll get this along with the slideshow shortly after the webinar as we, you know, dive into the five strategies for efficient vendor onboarding. Melissa: Um, you know, make sure if you do need to communicate something that’s not a question for the Q&A box, use the chat, but try to use the Q&A box and let it be as interactive as possible. Melissa: And without further ado, I will let Brian jump into it. Melissa: Go ahead. Brian: Great. Brian: Thanks, Melissa. Brian: And it’s it’s great to be back talking around one of my favorite topics, third party risk management. Brian: And you know today we’re going to be focusing on strategies for you know efficient vendor on boarding which is you know a really critical component because if you don’t get the on boarding correct then you know the risk decisions and risk metrics that you take based on that on boarding further down the line you know just won’t be accurate so I want to set the scene a little bit first of all so uh for it’s amazing how many organizations I see uh that really haven’t got a a functioning enterprise risk capability And most of you on the call must be saying well we do and that’s great but you know all organizations I think need to make sure that they have that endtoend holistic enterprise risk function operating effectively and capably throughout the organization you know regardless of size and scale you know it’s something that we absolutely have to have in place going forward and I think you know government agencies around the world uh you know communicating to their the citizens and organizations within their country countries that the risk from cyber threat especially coming through the cy cyber uh sorry the third party supply chain is absolutely you know prevalent and and critical and we all need to factor that into our risk based decisions and we’ll weave that through in the conversation today and you know focusing on what we’re talking about at the moment third party security um organizations that I see you know I do a lot of consultation some very large multinational organizations some governments but equally small to medium enterprise, charities, academia, etc. Brian: They all have some form of supply chain within their organizational structure and it really depends on the importance of how they treat the third party security within that life cycle and how they manage it and you know do the full life cycle management throughout it and I see some that take it extremely seriously you know have the right resources in terms of people process etc focused at it but equally I see some that just want to tick the box And you know, hopefully we have people on the call today that that want to take it seriously. Brian: And I’m going to hopefully give you some of my experience on on how to do the onboarding correctly so that the ongoing activity you take forward from that will will reap rewards for your for your organization. Brian: But then equally it’s around tooling. Brian: So obviously I don’t work for prevalent but I have been a customer of their their products uh for for numerous years in in many organizations that I’ve run security for. Brian: And I think uh We’re definitely beyond the world of Excel and you know many organizations are still trying to manage their their third party risk management using you know Excel. Brian: Excel is a great product. Brian: It has its you know purpose within an organization but it’s definitely not to manage third party risk. Brian: We’re we’re far too complex. Brian: We need data in near real time. Brian: We don’t need legacy spreadsheets etc. Brian: So we really need to recognize that we have to invest in that tooling to be able to give us the knowledge the insight that we need to be able to effectively manage risk not just cyber risk but risk within our within our supply chains going forward. Brian: So that vendor on boarding obviously I’ve said it’s a critical process to establish a company as an approved provider and and it really is it’s the same with anything in security really if you putting a security operations center into your organization the on boarding is the critical component. Brian: It it tells obviously an external tool or an external supplier what they need to know about your organization in the third party risk management world. Brian: We need to know absolutely everything. Brian: You know, it sounds a little bit mundane, but we need to know absolutely everything about that organization. Brian: Who owns it? Brian: What geographies do they operate in? Brian: What know capabilities or technologies do they sub out to fourth and fifth or end vendors down the track? Brian: Which geographies do they operate in? Brian: Where does their data reside, etc. Brian: So, we really need to know all of that information on the onset, but there’s a lot more as well which we’ll get in later in the deck. Brian: So why all of this focus on onto onboarding and I’ve explained a little bit about it being you know such a critical step but if I see you know all too often uh incidents and issues happening within the supply chain and you know when they go back and retrospectively look at what they knew about that supplier they didn’t perhaps know that they operated in that geography. Brian: They didn’t perhaps know that their data was being outsourced for other people to to work on it from within that organization. Brian: So, it really is critical that we we get all of that information up front and we can codify that into our our platforms and tools and make sure that we can run our risk models across that and check that we’re we’re happy with that. Brian: And equally, we have a lot of, you know, compliance and and regulation coming in are forcing us down that track as well. Brian: And, you know, please look at one of the other webinars I did for prevalent that really focuses down on the liance and regulatory elements that were forced to to to go down as well. Brian: But really looking at, you know, some of the key objectives that we’re we’re trying to to deliver. Brian: And this diagram kind of looks like opposing forces, but it but it’s not. Brian: It’s really about how do we work together collaboratively as a you know holistic business to deliver the outcomes that we want to give our customers. Brian: So risk mitigation is obviously what we’re looking at. Brian: It’s not just cyber risk, it’s you know risk in general. Brian: So getting that on boarding right is is really really critical. Brian: You know it can help us mitigate data breaches, data loss, regulatory and compliance issues. Brian: It really gives us that radar of information that all of the business not just the security teams. Brian: So the legal teams, the procurement teams, you know, the business relationship teams, the line of business teams, they’re all going to consume this information that we’re going to present to them further down the track. Brian: So we need to make sure that they’re set up for success and obviously we get that information right from the outset. Brian: Compliance, we’ve touched upon it briefly, but you know, sitting here in in Europe, well, actually the UK technically isn’t part of Europe anymore, but we’re still, you know, part of the GDPR regulation. Brian: In the US, you have things like CCPA, etc. Brian: But regulation isn’t going to go away. Brian: If anything, it’s only going to increase. Brian: So, we need to make sure that we’ve got, you know, a full and true understanding about our compliance obligations. Brian: If we’re selling products and services, is to citizens in certain countries. Brian: Uh there’s over 80 different data security requirements around the globe at the moment. Brian: Um and organizations and and countries that you know reside in some of those legislative environments have to make sure that they’re complying to those individual nuance requirements and it does get complex for a large global multinational. Brian: But you know using a tool like prevalent can help you navigate that complexity and again if you’re trying to do it yourself using a tool like like Excel or you know word documents etc. Brian: It really does become a challenge to try and navigate that landscape. Brian: You know what we’re looking at is is quality and I think quality and security go hand in hand. Brian: We want a quality outcome. Brian: We want to deliver a quality service to our to our business customers. Brian: We need to be able to ensure that we’re not being the security blocker. Brian: Uh all too often and you know I hope I’m not speaking out of turn here but this individual process in an organization if not done correctly can be a real blocker. Brian: You know the procurement function can see it as slowing things down. Brian: You know they’re ready to do a deal but the security checks haven’t been done. Brian: The security team have sent out a questionnaire. Brian: The organization has to fill that in. Brian: It then has to be returned. Brian: It has to be analyzed. Brian: The risk quantification has to be done across it and then obviously the dialogue and communication with the business and all that can take time but uh and and if it’s new supplier and more importantly you’re starting with a blank sheet of paper but what we’re starting to see obviously with tools like prevalent is that when you start that communication with the business and they say we want to start a relationship with company XYZ in all likelihood someone on the prevalent platform has already got a relationship with that business so when you start to you know input some of the details onto the platform you start to see information that’s relevant to your risk quantification flowing through straight away so you’re not starting with that blank sheet of paper waiting for that response to come through from, you know, the the the end customer or client. Brian: We also want to protect our company’s reputation. Brian: You know, one of my past CEOs used to not describe us as a security function. Brian: We were described as the brand preservation function. Brian: So, they invest, you know, multiple millions in in promoting the organization through marketing and advertising. Brian: And the biggest damage that can occur is, you know, a data breach and on the the front pages of the newspapers for the for the wrong reasons. Brian: So, we want to make sure that we’re protecting that brand. Brian: We’re protecting that reputation. Brian: And you know, our customers come to us and they entrust us with their data, their location data, their payment information, their home address, their date of birth, some very sensitive information. Brian: And they’re hoping and entrust they’re hoping that we’ve put the, you know, proactive security controls in to protect them going forward. Brian: But in all cases, that’s not true. Brian: So what we’re talking about today is making sure that we put those processes in place so that we’re effective in in doing that going forward. Brian: Business agility is is really critical here as well. Brian: As I said, we don’t want to create that that security silo and that security blocker. Brian: We need to work collaboratively with the business and and I do see this function or operation sitting within the security function and and often we can create a security silo and that leads me quite nicely on to the next slide where we discuss how we achieve this. Brian: So again I did a another PowerPoint presentation for for prevalent and you should look at that one as well which talks about you know how we really embed this function this process into uh you know the broader business working effectively with the procurement function the legal function etc. Brian: But if you are a security professional on the call you know you’re not alone. Brian: What we what we need to do is get this process running holistically across the organization and we need to build in our risk levers. Brian: You know, we want to know as much about these organizations as quickly as possible. Brian: Uh and what we have are things like our RFI, our RFP processes where we can start to codify requirements very early into the relationship and discount suppliers that don’t meet our security requirements or perhaps don’t meet our CSR requirements, etc. Brian: So we can start to ask those questions early and upfront so we can make sure that anyone who’s perhaps a finalist to be a supplier to our organization actually is pretty good and and meets the majority of our requirements up front. Brian: But in order to do that we can’t do that solely within security. Brian: You know we need to identify who our stakeholders are. Brian: We need to get them involved in the procurement process. Brian: So you know that’s the full breadth of the business. Brian: So it’s the security team, it’s the legal, it’s the IT team etc. Brian: Each of these different stakeholders are going to have a different perspective on you know what a secure supplier means to them and we need to capture those requirements. Brian: So that means working with those stakeholders get their specific you know operational requirements me being a security leader you know I have specific security controls that I would expect I’d expect them to you know comply to all the requirements with my security policy but the IT team are going to have a different set of requirements they’re going to you know have their technical requirements that relate to how the systems are operated, the 24 by7 capability, how the software is being procured, the licensing, you know, the patching and the updating and all of those aspects. Brian: So, it’s important that we hear those different voices and we capture them into our onboarding process. Brian: And as I said, you know, pulling those levers early, so incorporating those requirements into our RFI, RFP processes once they’ve been established, we push them out as part of our initial documentation, they can see that we’ve set our stall out really early. Brian: These are our expectations. Brian: This is what we require. Brian: You know, we can discount suppliers that don’t meet those requirements. Brian: So, that’s a really critical lever that we can pull very, very early. Brian: This can’t be an iterative, sorry, it has to be an iterative process. Brian: It can’t be static. Brian: So, it’s not something that we create, we push into the organization, and that’s it done. Brian: It’s the same with everything else in security. Brian: It has to be living. Brian: It has to be breathing. Brian: It has to to react and that’s why again using something like prevalent that can bring in the threat angle is really important to us. Brian: So we’re not just talking risk here we’re talking threat. Brian: So an organization’s threat profile depending on you know the sector it operates in the geographies it that it operates in as well. Brian: That threat posture can change on a daily basis. Brian: When the threat change the risk changes as well. Brian: So if we’re only looking at threat then obviously we’re not going to really you know have an accurate risk position. Brian: we really need to factor in that that threat dynamic as well. Brian: So that review and revise is is absolutely really critical. Brian: We need to constantly evolve to make sure that you know the process is meeting the business needs and and how do we do that? Brian: We need to communicate regularly and you know I I will say honestly being a security professional this is one of the areas that we often fall down on you know being open and transparent with the the broader business. Brian: We need to break down those security silos. Brian: We need to get the security team out from behind the security speed gates and really embedded and working with the the broader business. Brian: We need to verify and validate that our services that we’re running on behalf of them are meeting their requirements and needs. Brian: And if they’re not, we need to adapt and and change that process because even though this is quite often seen as a security process, it’s actually delivering that capability and service for the for the whole business. Brian: So we need to factor in those requirements and voices. Brian: and adapt and react as appropriate. Brian: So um what we need to do is you know not all suppliers are equal and let me just build this slide. Brian: So what we talking about here is is inherent risk scoring. Brian: So what do I mean by inherent risk scoring? Brian: You know that’s our vendor evaluation process and it can really make sure that we’re focusing our what are finite resources in terms of people and budget and capability on those vendors that that really matter. Brian: Every organization is going to have a spread of vendors that support them. Brian: There’s going to be people that deliver ingredients for the kitchen for and the the canteen for the for the employees and there’s going to be people that manage the you know the privileged access in the the data center etc. Brian: So there’s two you know opposing uh ends of the spectrum that will dictate how much effort and resource we focus on from a security perspective. Brian: So we need to identify those risk factors. Brian: So where are we going to spend our our time and resource and it’s fairly normal and typical to to tear the suppliers that you know deliver services and products for our organization. Brian: So again that’s working with the security team so the broader experts within the security team and the stakeholders with within the business to identify the criticality of this supplier. Brian: What are the products and services that they’re going to be delivering for us? Brian: You know what level of access are they going to have? Brian: Is it logical? Brian: Is it physical? Brian: Are we going to be sending them customer data or are they going to be accessing customer data on on our sites? Brian: There’s a whole host of factors that kind of dictate to us how much effort we need to put into assessing the risk that they pose to us. Brian: And once we’ve done that, obviously we need to assign our our risk scores. Brian: We need to land them within a segment. Brian: You know, particular segments, you know, tier one suppliers means that they might get an on-site visit, whether it’s by our organization personally or or someone that does that on our behalf. Brian: But obviously, you know, even using the prevalent platform, it dictates how much effort and detail we put in there to understand the true risk that that organization presents to us. Brian: That certainly doesn’t mean that we ignore those in in tier three. Brian: I’ve seen definite situations before and the reason I use the the canteen example is I’ve seen organizations breached by platforms that, you know, perform basic tasks that could be perceived as basic tasks, but they still have access to you know tools and platforms within the organization. Brian: So it doesn’t mean that all of our focus goes into tier one and we ignore tier three. Brian: You know that that risk assessment has to be holistic and we still have to understand the level of access and you know data access they have within our organizations. Brian: So we use all of that you know the taring you know the risk factors that we’ve you know captured to really you know identify those risk lever points. Brian: So what are our critical pinch point. Brian: How could our organization be compromised? Brian: What would that look like from a risk perspective? Brian: And how do we codify that into our into our requirements? Brian: You know, it’s fairly typical for an organization to just generically say we expect you to comply to our entire security policy, which is, you know, an individual approach, but you are going to have to tailor that for for certain suppliers. Brian: If you’re outsourcing the management of your data center, for example, that becomes a lot more sensitive. Brian: conversation and you just have to comply to our our security requirements. Brian: That means you really get into the detail around how are things actually performed, who are the people that are going to be performing those tasks. Brian: Really getting, you know, down into that down into that detail. Brian: And then we obviously have to evaluate our vendors. Brian: And so hopefully at this stage we’ve got a little bit of a short list. Brian: We weeded out those that aren’t going to meet our criteria and we’ve got a, you know, a short list of of three or four vendors that can absolutely meet our requirements. Brian: But we need to know a little bit more information about them. Brian: So in that RFI RFP process, we’re not going to know everything about their financials. Brian: We’re not going to know everything about their ownership models, for example. Brian: So this is getting broader than cyber, but it’s it helps to build that end-to-end holistic, you know, risk picture. Brian: So we really need to get into that detail as well. Brian: And, you know, often we’re we’re focused down on cyber security, but you know, as you’ll see weaved throughout this presentation, in order to really captured the risk. Brian: We have to go go broader and we have to adjust and amend. Brian: As I said before, you know, this is an evolving process and threat plays a key role in here as well. Brian: You know, a key supplier one day might become a a non-key supplier. Brian: The other day, looking at things like the Russian conflict, I support I previously supported many organizations that had business units operating in in Russia, you know, geopolitical conflict, you know, really changes how we procure and you know the the suppliers that are approved within our supply chain and for example the current conflict or potential conflicts that are occurring in in China what would happen if we had to decouple our entire supply chain from China you know we have to think through these these models in advance and and understand if we’re starting business relationships with people not only what are our suppliers but what are their suppliers and and where do they operate so we have to as I said at the beginning really get into the detail So the key message here is you know we can’t wait till the end of the process. Brian: Again it’s like other security processes. Brian: We want to be proactive. Brian: We want to start early. Brian: We don’t want to be you know developing software and people can do what they want and then we just do a penetration test at the end. Brian: It’s exactly the same here. Brian: We want to start those questions early understand really what is the risk that’s presented to us so we can get that on boarding done effectively uh and obviously support us ongoing going forward. Brian: So what are you know we want to you know identify and and mitigate you know some of those top onboarding risks. Brian: So what what do I see out there on on a daily basis? Brian: What do I think some of the the top risks that I see and people tripping over? Brian: First of all 100% coverage. Brian: So large global multinationals it gets complex. Brian: For example you know your business unit in in the USA might use a supplier for you know services X Y Z. Brian: Your business unit in France might use the same supplier for services ABC. Brian: You need to have that global holistic view. Brian: Uh all too often, you know, you’ve got a siloed view or you haven’t got the full picture and your suppliers aren’t going to help you here. Brian: I mean, this is my, you know, pessimistic view, but having, you know, ran security for for large global multinationals, some suppliers play on that. Brian: You know, they will slice and dice you. Brian: They will, you know, give you different price points in different countries. Brian: It’s not in you know their best interests to actually say here’s everything that we do for you and here’s our global services and here’s the prices you pay in all your various different countries. Brian: So if they can you know leverage that lack of global capability that perhaps you have then then some will certainly not all but but some will so we need to have that ability to get that global view and how do you do that so it’s around you know centralizing your procurement centralizing your cost centers so you can see any spend that is related to you know finance or IT or security is going through some form of centralized choke point so you can start to pull that global view of of spend and and suppliers together so that 100% coverage is is absolutely key and and equally I’ve seen incidents happen where you know people just haven’t realized that they’ve been using that supplier in in that country and and again that’s where they’ve been trying to use that that manual pro process that we’ve discussed before and I think we have to leverage the innovation that’s actually occurred in this space and and and I have operated personally in that Excel world simply because uh you know I’ve got some slightly gray hairs now and you know I lived in a world where these platforms weren’t available and we had to run Excel tools and platforms and it gets very complex and and often in security teams this area is a stretch from resource and and focus so we need to help them out as much as we can So if you’ve got two or three people trying to manage 2 and a half 3,000 suppliers globally using Excel, they’re going to struggle. Brian: But if actually you’ve got two and a half, three people that are focused on a on a platform that’s been purposebuilt to manage, you know, risk compliance and threat within the supply chain that can work. Brian: So you know, it’s around, you know, giving them the ability to succeed and setting them up for success. Brian: That’s absolutely key. Brian: One of the other things I see is, you know, the lack of due diligence. Brian: So the the lack of breadth and depth. Brian: So it’s making sure again that we’ve got that taring done effectively from the outset. Brian: Making sure that we understand the full scope of services that this organization is is going to deliver to us. Brian: Making sure that we’re not falling foul of, you know, compliance in terms of inadequate contract terms. Brian: You know, GDPR, CCPA, or any of the other 78 data requirements around the world dictate to us that if we’re outsourcing, if we’re offshoring, if we’re letting other people manage, manipulate, interact with our customers data, then we have to be, you know, put in the right controls and processes. Brian: And part of that is, you know, defining who is the data owner, which would always be us, and who is the data processor, etc. Brian: And, you know, putting in place the the governance and the contractual terms and clauses, that, you know, both parties fully and truly understand their roles and responsibilities. Brian: And this isn’t just covering us off from a legal perspective. Brian: It’s doing the right thing on behalf of the customer because we’re setting that relationship up very clearly from the outset. Brian: If you have access to our data, here are our expectations. Brian: They are non-negotiable and here’s the governance and the KPIs and the KIS and the monitoring and the reporting that we expect on a on a on a varying frequency to make sure that we can check that you are adhering to those requirements and processes up front. Brian: It sounds And it sounds ownorous but that’s the world that we have to operate in to make sure that the suppliers that we’re working with are doing the right things that we’ve promised on behalf of our customers. Brian: The other thing I see is uh no life cycle management and this is you know especially prevalent but not prevalent in terms of the application prevalent in terms of what I see out there in in the marketplace. Brian: If you’re running a manual process and you are sending out questionnaires and you’re capturing those and analyzing them and and building Excel spreadsheets up etc. Brian: What we see or certainly what I noticed in the past is as soon as that information is received, you can pretty much disregard it because it’s out of date. Brian: And if we all think about our own organizations and how much they change, how much they morph almost on a daily basis, new products and services are launched, new management, new approaches, new tactics, new strategies, new geographies that you’re operating in. Brian: If you’re only interacting with that customer once per year to send them a questionnaire. Brian: You know, you’ve got 364 days of lag before you might pick up, you know, something that is actually a fairly material risk to you and to your data. Brian: Perhaps they’ve made their own choices to outsource and and offshore part of their organization. Brian: And if you haven’t got the right contractual terms set up that they have to pre-notify you in advance of material changes like that, then you might not discover it for for almost a year. Brian: So it’s around, you know, how do you make sure that you’ve got those hooks and those levers and, you know, the contractual requirements and the appropriate governance to be able to detect changes that are really critical to to managing the risk within your supply chain. Brian: And that really leads us on to having meaningful metrics and and I’ve seen some pretty awful reporting and I’ll I’ll show you one on the next slide, but it’s you know what do we need? Brian: And and I think about this slightly differently rather than saying here’s our entire security policy and each one of them has a KRI and each one has a control and each one has a KPI etc. Brian: So you end up getting you know a 400page KPI report coming back from suppliers and it’s really difficult to see the wood from the trees. Brian: It’s really focusing down on what are those meaningful metrics what are those lead and lag KPIs that would you know switch the light on for us immediately that this is an area that we want to show more more focus and attention. Brian: So there’s some you know fairly up front thought that needs to go into this in terms of, you know, what is this service? Brian: What criticality is it to the organization? Brian: Therefore, you know, what metrics do we want to be able to get from this supplier to make sure that they’re doing what we expect them to do? Brian: And ultimately, we’re not exposing our organization to to downstream compliance or risk and that we’ve covered that off proactively because that’s ultimately what we’re trying to do here. Brian: Uh we don’t want to be reactive. Brian: No one wants to see, you know, one of their suppliers on on CNN or Sky News or something similar having a breach without us knowing about it, you know, without us seeing that that has the potential capability to happen. Brian: So, you know, if if a supplier isn’t doing their perimeter patching, then that’s a pretty good indicator that they’re going to have issues. Brian: So, we need those hooks and levers to detect that early so we can, you know, terminate that relationship and and move our, you know, contracts to someone that takes security more seriously going forward. Brian: So, and that’s why, you know, this area can be challenging because you know you magnify that by two and a half 3,000 vendors more in some cases it become can become a bit of a challenge but using the tools can can really help. Brian: So when I said I’ve seen some you know awful examples of of reporting you know this is a bit of a mockup but it’s you know it’s very similar to to something that I’ve seen in reality and this you know can go on for for pages and pages and you know it’s really impossible to see the wood from in the trees. Brian: So you’ve got your list of suppliers down the left. Brian: You got, you know, your critical security policy, you know, themes or or control groups along the top. Brian: And then obviously a very complex matrix with, you know, so many more colors in the mix. Brian: It’s really impossible to understand what it’s really trying to tell us. Brian: And you know, if this is presented to to a board member or an executive or even a business stakeholder, you’re requiring them to do the analysis on the fly in terms of well, what is that control? Brian: and you know how important is it to us and that’s not their job. Brian: It’s it’s our job as security professionals to do that on their behalf and present them you know clear concise information around here are our recommendations based on this risk. Brian: Here’s what we’re recommending doing. Brian: So obviously the one on the left it’s you know it’s static. Brian: It’s an Excel spreadsheet. Brian: You can try and click on a box but you know it’s not going to do anything. Brian: It’s out of date as as soon as it’s produced. Brian: And you know using this this process. Brian: Probably these suppliers, as I said, are only touched once a year. Brian: So that information isn’t isn’t changing on on a on a regular frequency. Brian: But we need to adopt a better way. Brian: And there is a better way. Brian: So you know, codifying and and ultimately that’s what we do. Brian: We codify our security policies into into platforms and tools like prevalent. Brian: We tell it what we uh you know, what we take seriously, what we see as critical, what we’re more flexible on, what we see as major. Brian: risks, what we see as minor risks, what our threat posture is, etc. Brian: And the tool will do the analysis for us. Brian: It will, you know, pinpoint within our supply chain where we need to focus, where are the key threats and risks, you know, what do we need to, what conversations do we have to have with the business. Brian: And the key thing is we can start to drill down into data sets. Brian: So, we start high level, but we can go low level. Brian: So, we can sit down with a business stakeholder and we can say, look, we’re having this issue with a with a supplier. Brian: And you can introduce that geopolitical angle here as well. Brian: Or you can use other examples like the Suez Canal being blocked or the horsemeat scandal in in Europe. Brian: So there’s, you know, various other factors that would change the risk profile of a potential supplier depending on what your business is. Brian: If you’re a financial services business and perhaps you’ve outsourced your PCI compliance to a third party and they’ve, you know, they’ve started caching CVBS, then, you know, that’s a major risk for you. Brian: If you make meat and and all of a sudden you’ve discovered one of your suppliers has, you know, been in introducing horsemeat as was happening in Europe. Brian: Again, that’s, you know, a key risk that’s going to present itself in your organization. Brian: So, I realize there’s a full dichotomy of of organizations on the call. Brian: So, this really does get down into sector specifics in terms of, you know, what is actually important for me and what are the things that I really want to look out for as well. Brian: So, you know, what metrics should we be measuring? Brian: You know, what do I do I see as in important going forward? Brian: So risk of course we want that to be balanced. Brian: We want it to you know not be focusing on lead and lag. Brian: We want you know to be informed. Brian: We want it to be quantifiable. Brian: We want it to be repeatable. Brian: And what I mean by repeatable is using an Excel spreadsheet. Brian: If you put that in front of analyst A or analyst B, you’re going to get a different outcome. Brian: You’re not going to get a repeatable risk quantification or risk assessment, you know. Brian: So They’re all we’re humans. Brian: We analyze data in different ways. Brian: We have different biases for example. Brian: So we need to remove those as much as possible and make sure that we’re getting a a quantifiable repeatable risk decision that is you know uniform throughout the organization and it’s based on you know best practice framework. Brian: So obviously organizations use different frameworks. Brian: So whether you’re using NIST or you know you’re using standard of good practice whether you’re using ISO or you know whether you’re using any of the other frameworks as well. Brian: You need to be able to relate those controls and control failures to those frameworks as as quickly as possible. Brian: But ultimately, we want to know how to positive positively influence that risk position. Brian: We are the custodians of risk in this space for the business. Brian: We’ve got delegated accountability to you know capture risk, give recommendations, treat that going forward. Brian: Threat is a major angle that is introduced by using the these platforms and and threat is a is a gamecher and and absolutely we shouldn’t discount the importance of of bringing threat in you know a good example that I’ve used is you know uh I was working uh with a bank uh in Europe that had you know spent a significant amount of money on on security transformation and they expected to see their risk profile reduced significantly but actually when you overlay the threat dynamic you know what was happening in that sector you know actually their risk profile hadn’t gone down a lot uh And you know that’s for logical reasons because you know risk and threat are inherently linked and we can’t just use our standard nine box quadrant and say right we’ve delivered a process or we’ve delivered a technology therefore our risk has come down because you know we operate in a world with with shifting sands. Brian: We operate in a world with different threat dynamics and we need to make sure we’ve captured that into our into our decision- making and you know one of the things with with prevalent is it captures that threat. Brian: You know it understands it has those hooks and levers in terms of what’s going on with with individual suppliers and we get that view in in near real time. Brian: Something that again you’re not going to get with your manual process and and compliance you know we need that contextdriven compliance we need to understand what we’ve committed to you know where are we operating within what jurisdictions are we operating in but they are all different if you compare GDPR to mass in Singapore for example or CCPA or you know the Indian or the South African legis ations and jurisdictions. Brian: If we have some form of breach, we all in those jurisdictions have to operate in a slightly different way. Brian: How how quickly do we notify regulators? Brian: What’s the process of communicating with with customers? Brian: We need to make sure that we are compliant to that not just for a regulatory but to do the right thing for our customers. Brian: And we’ve all seen you know organizations that have had some form of issue or breaches and you know even though the breach has occurred organiz organizations and customers can understand if the communication is very clear, very concise and we’ve seen, you know, organizations handle issues and breaches very well. Brian: And we’ve seen organizations brush breaches under the carpet and handle them very poorly as well. Brian: So yes, we need to look at compliance, but equally we need to do the right things from our customers. Brian: And then the coverage is is absolutely key. Brian: And you know, I’m stressing this, I know I’ve covered that before as well, but it’s again an issue that I see within, you know, some of the programs that I go and look at is that we we’ve only got partial coverage and partial coverage means partial risk. Brian: It means partial threat and it means that we’re not giving the business that holistic view that they need to have. Brian: So this needs to be a global process. Brian: So wherever your organization operates, you know, it might not just be a sales operation etc. Brian: You might have engineering divisions in different business units and different countries. Brian: But this process needs to run holistically end to end. Brian: so that you’ve got no gaps because you know regardless where they operate they will have some form of supplier whether that’s a you know a landlord for a building cleaning contract etc. Brian: They all need to be factored into this process in in some way shape or form. Brian: Okay. Brian: So you know what are some of the you know key KPIs specifically within the onboarding process that I think we should look at. Brian: So you know vendor performance is absolutely key and by this I mean something like what are their SLA, what are we going to hold them to account from, what compliance are they, you know, liable to and are going to pass towards us, what are things like their response times, what are their quality ratings, etc. Brian: So, we need to make sure that we’re working with someone credible fundamentally. Brian: So, you know, we’re not just assessing cyber risk here. Brian: We’re assessing vendor risk. Brian: And, you know, part of that on boarding process is making sure that we’re not bringing a, as we say in Europe, a bad egg or someone that’s just not suitable for our organization. Brian: They might have all of the capabilities from a security perspective. Brian: They might have all the capabilities from a technical technical perspective, but they’re not might not fit our culture. Brian: You know, just the way they work, you know, their their management team, it might not glue together. Brian: So, all of these decisions need to go in and come up with that that whole vendor performance, you know, coverage. Brian: I think we we you know, we’ve had plenty of conversations on that, but but absolutely we need to make sure we’ve got that that coverage end to end. Brian: You know, vendor risk metrics. Brian: So, you know, these are what I call the whole KRIS such as you know what are the number of security incidents they’ve experienced how have they how have they handled them what are their compliance and regulatory requirements and equally things like what are their you know what’s their financial stability and you know getting those hooks into that that broader risk profile is is really important contract compliance you know that might include something like the contract terms the pricing structure and and ultimately you can see this going a lot broader than than cyber security but from that on boarding process. Brian: That is something that we’ve we’ve fundamentally got to do. Brian: Customer NPS, how satisfied are their customers? Brian: Because ultimately we’re going to become one of them. Brian: You know, reference calls and and you know, I’m a big advocate here. Brian: The vendor will obviously offer up a couple of customers to have those reference calls with, but ultimately you need to do your own own due diligence as well. Brian: You need to, you know, ask within your networks, you know, of your senior stakeholders and understand who has relationships with this particular vendor, you know, what’s their particular experience of that as well because personal recommendations of of customers that you know and trust can can go a long way there as well. Brian: And then you have the operational metrics as well. Brian: So what’s their uptime? Brian: What’s their availability? Brian: And this is going to shift and change depending on the service. Brian: But you know setting our stall out up front to actually show this customer that this is an area that we take extremely seriously and they will get that through this on boarding process. Brian: This isn’t a company that you know, we we ask for a service, they give us a price, and we sign on a dotted line. Brian: They can see by the process that we’re going through that not only do we take cyber security seriously, we take data security, we take our compliance, our legal, our operational, you know, commitments to our to our downstream customers extremely seriously. Brian: And that’s going to be, you know, obvious based on the the conversations and discussions that that we’re having. Brian: And again, we need to, you know, assess beyond cyber. Brian: And we’ve touched on a couple of those risks that can, you know, materialize and and present themselves, things like the shortage of silicon to be able to make computer chips, the sewers canal being blocked, etc. Brian: So, there are there are are issues and risks and, you know, geopolitical stability is a is another one as well. Brian: So, there are, you know, factors that can influence our supply chain that we really need to to to understand. Brian: So, you know, reputation risk is key, business continuity risk. Brian: So, obviously, we want to factor in our own business continuity. Brian: So is this an area that is so critical to us that we don’t award the contract solely to one supplier and we split that up. Brian: So we have two suppliers that you know geog uh that are separated from a geographical you know status. Brian: So if there’s a situation like god forbid the the earthquake that occurred in in Turkey, we’ve got another supplier that can you know mitigate our supply chain in a different location. Brian: So we really have to think these things through as well. Brian: We want that process to be global. Brian: We’ve talked about that. Brian: We we need it to capture everything holistically. Brian: We need to make sure that we’ve got all of these processes flowing through and all the information feeds that we need. Brian: But fundamentally, if we haven’t got the onboarding process, we’re not going to get that right. Brian: What I’ve experienced personally is if you don’t get it in the contract at the outset and you start to retrospectively ask for additional things, those additional things put a a cost burden on your supplier. Brian: and you know it’s it’s you know up to them whether they reopen contract negotiations or reissue work orders for additional costs based on what we’re we’re asking for. Brian: So it’s really good to get this you know identified and and set from the outset. Brian: We don’t want to run separate processes for each of these different areas. Brian: So we’ve we’ve talked about you know cyber risk, we’ve talked about technology risk, we’ve talked about procurement risk, legal risk. Brian: It would be a logistical nightmare if each of these divisions and functions decided to stand up a platform and tool to manage their individual risk profile. Brian: And they don’t have to because we have, you know, technology that can do that holistically, but us as security professionals need to make sure that their needs and their requirements are are factored into that that process and they’re getting the right output. Brian: You know, they’re getting the information that they need to do their job. Brian: So, we’re not just making sure that the security team is good. Brian: We’re making sure that every stakeholder, those that we put at the outset, really have the information that they need. Brian: And if they haven’t, we have to adapt to to make sure and we need to make sure that we’re we’re in near real time. Brian: So, you know, businesses operating, you know, in on a digital footprint. Brian: Now, information that is hours, days, months, perhaps years out of date is of real little value. Brian: So, we need that information to be as upto-date as possible. Brian: And that includes the, you know, the threat and risk that is present in our supply chain. Brian: But, but equally thinking through proactively, you know, if we’ve got critical areas that are outsource. Brian: How could we mitigate that in advance? Brian: So, it’s putting that business continuity. Brian: It’s putting in place, you know, that disaster recovery lens as well. Brian: Thinking through, you know, proactively, how would we mitigate this vendor if they were unable to provide that product and services to us. Brian: So, it really is, you know, thinking that through in advance and putting those hooks and levers in place. Brian: Right. Brian: So, I think that’s my final slide. Brian: I’m going to hand over to to Scott and I see some questions have come in and I’m more than happy to to answer those at the end. Brian: So Scott, over to you. Scott: Awesome. Scott: Thanks so much, Brian. Scott: Uh if you could advance to the next slide, please. Scott: You know, thanks everybody for sticking in to the end here uh as we you know kind of review a little bit of what Brian said and translate that uh into you know what pre can do to help you address the issue of onboarding uh you know of your vendors and third parties in the organization. Scott: Let me start out by saying this. Scott: When we talk to customers, they invariably tell us they want to accomplish any one of these three things. Scott: Number one, to help them get the data they need to make better decisions. Scott: And that data can be at the time of onboarding. Scott: That can be the time of making a vendor selection decision even before onboarding. Scott: It can be um understanding how to assess the vendor based on you know the outcomes you want to achieve. Scott: Getting the data to define and measure KPIs and KIS. Scott: Uh getting you know data to determine whether or not you know the vendor is compliant with you know whatever you in a regulatory regime you need to align with, right? Scott: Good um uh good data to make good decisions. Scott: Second, uh increasing team efficiency and breaking down silos. Scott: You know, what does that mean? Scott: Um often times we see and I think uh Brian touched on this a little bit was in a lot of organizations we see thirdparty risk owned by um you know the IT security team but the relationship is owned by procurement or or some combination of different departments perhaps you know audit legal or others. Scott: And each one of these teams, as you well know, uh each has their own um you know, risks they want to manage or metrics they want to track. Scott: And if you do that in silos, it’s not going to lead to a very efficient outcome. Scott: So, break down the the the silos and increase team efficiency. Scott: And then third, evolve and scale your program over time. Scott: And by that, I mean, uh be ready for, you know, an influx of vendors or an outflow of vendors or, you know, changing business requirements, being able to be elastic and and and and scale your program over time. Scott: Those three big decisions or outcomes or goals that organizations typically are looking to achieve with regard to third-party risk. Scott: Next slide, please, Brian. Scott: Uh, and you know what you’ll see is that, you know, prevalent helps to address each of these three goals and outcomes at every stage of the third party risk life cycle. Scott: And, and Brian, you can build it out uh two more times to to kind of complete the the slide there. Scott: There you go. Scott: Um, you know, the first thing we do is we help to add automation and intelligence to uh sourcing and selecting decisions. Scott: Um you know good risk based insight on you know cyber uh previous breaches um financial health of of a particular third party or supplier um whether or not they have been sanctioned or have any compliance violations against them you know whatever. Scott: Uh and we help to consolidate that into a risk profile that can help you make a good riskbased decisions on the on the vendor much in the same way that you’re making a business decision on whether or not that vendor or supplier partner meets you know your company’s technical requirements. Scott: We add the automation and centralize that information in in one particular place. Scott: Uh second when it comes to intake and onboarding vendors we help you create a single source of supplier risk profiles intake processes contracting and onboarding workflows because we’ve integrated the sourcing and selection the RFX management the contracting and the ongoing due diligence assessment. Scott: process of thirdparty risk in a single solution. Scott: Then you have a seamless approach to moving that vendor throughout each one of those stages of life cycle with one set of onboarding workflows or sorry uh assessment workflows to to to uh to extend throughout the the the life cycle. Scott: When it comes to scoring inherent risks uh as as Brian talked about um we give the ability to score and categorize and tier uh vendors based on datadriven insights. Scott: Typically an internal assessment that then has some external criteria used to sprinkle into add context. Scott: When it comes to comes time to perform a deep uh controlsbased assessment of uh that thirdparty vendor or suppliers environment, we give you more than 200 ready-made assessment templates in the platform to streamline the process, you know, of assessing different requirements, security, privacy, ESG, compliance, financial, multiple different domains. Scott: Uh we help you monitor and validate those controls over time as well with continuous cyber business reputational and financial insights. Scott: So that once you’ve onboarded the vendor um you know made a good sourcing and selection decision onboarded the vendor got a good inherent risk score and are able to kind of define and execute on your assessment strategy. Scott: You can fill gaps in between those assessments and validate their controls as well. Scott: You know Brian mentioned uh KPIs and KIS you know with the prevalent platform you can extract um you know very specific measures and metrics and attributes from contracts and automatically populate those into a central risk register to manage those KPIs and KIS with distinct owners and measurable uh delivery dates uh and more throughout the life cycle. Scott: Uh and then finally uh you know every relationship comes to an end uh and when it comes time to offboard a particular vendor terminator relationship you know we give you a very prescriptive checklist and a set of uh contract terms to evaluate and tasks to complete to make make sure that they’re offboarded and you’re not, you know, leaving data out there or access uh unterminated for example uh to your environment. Scott: At the end of the day, three things here. Scott: Simplify and speed up onboarding with a single source of the truth and a process to back it up. Scott: A single streamlined process to assess vendors across the life cycle and then unify teams uh across that life cycle as well. Scott: Next slide, please, Brian. Scott: Um very specific to today’s top of onboarding, profiling and tiering. Scott: We talked a little bit about this on the previous slide, but you know with prevalent you can onboard vendors with you know a spreadsheet upload an API to an existing uh system or an enterprise intake process that’s available to all employees that you delegate to. Scott: Uh it’s a simple out-of-the-box assessment with clear scoring that manages interacts inherent risks. Scott: Helps you tier suppliers based on a bunch of set of different criteria. Scott: Uh build a comprehensive profile that includes all of the information about that supplier, thermographic details, ESG scores, modern slavery statements, financial information, fourth party relationships, and more. Scott: Um, and then assess your third parties, and then, you know, bring in a bunch of additional intelligence on additional risk domain areas. Scott: Uh, next slide, please, Brian. Scott: Uh, uh, speaking of, uh, risk domain areas that that we cover just very briefly, you know, we we’ve included a sample here of the six primary risk domain areas that we collect information on either via continuous monitoring, scanning, importing data from outside or uh that we collect via um uh internal assessments uh in the organization and we pull these things together. Scott: Next slide, please, Brian. Scott: I think it’s my last one. Scott: Yeah. Scott: So, what our what our goal for you is what our approach is for you is to help your organization accomplish three things. Scott: Help you be much more smarter in how you approach third party risk through through uh performance insights, analytics, role-based reporting to tie back to that first goal that we talked about making good risk based decisions. Scott: Uh second, give you a single source of the truth for the enterprise, combine assessments and monitoring in the same solution and look at risk across the life cycle to look at risk in a unified fashion and tying back to that first slide to knock down the silos. Scott: And then finally, uh to be very prescriptive in how you assess and monitor and manage your third parties and the relationships uh through got that lifelong with built-in intelligence, automated workflow, and more to help you be agile, grow, and uh and mature your program over time. Scott: That’s the kind, you know, kind of our approach there, how we build off from onboarding and extend throughout the relationship. Scott: That’s all I have to share. Scott: Melissa, we’ll open it back up to you. Melissa: Perfect. Melissa: Thank you, Scott. Melissa: Now, I must ask you all to drop in any more questions that you have into our Q&A box. Melissa: I had to throw a mustache joke in there because Scott is rocking it. Melissa: Um, so go ahead and check out your screen. Melissa: You’ll see that second um poll come up and you know I’m curious, is there a TPRM project on your radar? Melissa: I know it’s Q2. Melissa: People are starting to get in gear. Melissa: Um, you know, if you’re looking to establish it, be honest. Melissa: We do follow up with you. Melissa: So, uh, let’s go ahead and get through some of these questions. Melissa: Um, Brian, is there any question that sticks out to you more than the others because we do have like six minutes left. Brian: Yeah. Brian: Yeah, I’ve just opened it. Brian: up to be honest. Brian: So I can I can do these uh do these quickly. Brian: So you know someone’s asked you know how early should we do the risk tiering? Brian: Should it be conducted as part of the RFX process? Brian: So I think you can codify your your ting into the RFX process and Scott’s just talked a little bit around that in terms of you know how prevalent can assist in taking your prospective supplier through that you know journey as part of the platform and you can move them from you know prospect to customer but absolutely you can include that tiering I think it’ll be, you know, fairly evident. Brian: You know, there’s typically three tiers within an organization. Brian: Are they going to be one, one, two, or three? Brian: You know, you just have to be a little bit cautious. Brian: Sometimes supplier owners want their c want their supplier to be lower down than you want them to be down. Brian: So, you need to make sure that you’ve got the, you know, boundaries clear about where that supplier is going to going to be landing. Brian: Uh, Melissa, is there any other ones you want me to ask? Brian: I’m just going down. Brian: Um, hang on. Melissa: Let’s see. Melissa: There’s a few even Scott maybe uh some of those might be for you. Melissa: Um so maybe you can pick one that sticks out. Melissa: Uh leveraging data privacy components into this process. Melissa: Did you want to answer that one? Melissa: You want to Scott: uh yes. Scott: Uh Melissa: either you or Brian. Melissa: It’s up to you. Scott: Yeah. Scott: Um which one is it? Melissa: Um how might you leverage data? Melissa: privacy components into this process like to leverage intellectual economies of scale. Brian: Yeah. Brian: Yeah. Brian: So, um let’s trying to understand what the question. Brian: How might you leverage data privacy components into this process to leverage in intellectual economies of scale? Brian: So, I assume this question is you know how you know data data privacy data privacy regulations things like GDPR. Brian: So, so ultimately we want to make this as as seamless as possible. Brian: Um you know If you’re trying to manually assess, you know, exposure to data privacy requirements on your supply chain, that’s a fairly ownorous process. Brian: If, for example, you codify your requirements into a tool like like prevalent, ultimately becomes a tick of a button or click of a button to actually say, you know, what is our exposure based on what this supplier is is telling us. Brian: So, so in terms of, you know, speed to understand, you know, the answering of of audits, you know, are we are we in breach of data privacy requirements? Brian: Are we adhering to data privacy requirements? Brian: It it certainly comes a lot quicker using a tool like like Prevalent. Brian: Scott, did you read that in another way or do you think that’s, you know, hit that one? Scott: No, I hit I think I agree with you there. Scott: Um, I mean, ultimately, you know, that I’ll kind of look at it from the from the prevalent perspective first. Scott: You know, if you have an outsourced, you know, provider, for example, an IT provider that’s, you know, managing or touching or accessing your data, you know, you can build a data privacy assessment uh into your general vendor risk assessment program for that vendor. Scott: Identify any issues or shortfalls and then recommend remediations from there and then implement some level of continuous monitoring so that you can look for your data in the places where it shouldn’t be. Scott: Uh and then and can kind of validate whether or not their data security controls are in place. Melissa: Perfect. Melissa: And we do have one question in the chat. Melissa: Um I’m going to read it real quick. Melissa: Since TPRM is an operation process and not a profit center. Melissa: What can you add about adding value in the capacity of mitigating risk but controlling overhead to manage the process? Melissa: Any input on how to achieve this? Brian: Yeah, I think this is a problem that all security uh functions experience in some way, shape or form. Brian: You know, security is a is a cost by default. Brian: It’s not a not a profit center at all. Brian: And you know, I’ve been in many boardroom conversations around, you know, we need to invest in this capability etc. Brian: And you know I’ve had responses like this doesn’t make us any money etc. Brian: But you know this is ultimately an insurance policy for for the organization not just TPRM but the entire capability that the security functions offer and if you’ve been proactive in in investing and doing the right things in this capability and you have an issue just like an insurance policy it’ll be there to assist you and and help you out. Brian: But if you haven’t you’ll find yourself exposed and find yourself having those challenges. Brian: So I think it’s around you know recognizing that you know being proactive and and investing in these spaces will pay dividends in the future and you know nowhere in security unless you’re you know a large telco or managed security services provider and you’re providing products and services for customers security doesn’t generate generate revenue typically for an organization. Brian: So everything they do is a cost right but I think that you need to spin the message on its head and you know actually demonstrate the value that the security organization is delivering in terms of you know potential risk mitigation and some of the KPIs and KISS you can set up or show them that you can set up will help leverage that right so it’s mitigating potential you know spend or or exposure that’s going to come down down the line without this process in place right Melissa: perfect well that leaves us at the top of the hour um thank you Brian for coming back and Scott thanks everyone for all your questions I know we have a few outstanding ones. Melissa: So, um, feel free to email me directly. Melissa: I put my email in the chat or [email protected] is always a good one. Melissa: Um, and lastly, I’m glad you all could join us today and I’ll see a handful of you in your inboxes and at a future webinar. Melissa: Take care everybody. Melissa: Thank you so much. Brian: Thank you everyone. Brian: Bye everyone.