利用托管服务加速第三方风险管理

Peter: Okay, welcome and thank you for joining our webinar today. Peter: This is accelerating thirdparty risk management with managed services featuring Nasser Fatah. Peter: Nasser is a cyber security leader with over 20 years experience in finance and healthcare. Peter: Also, pretty sure that Nasser holds the world record for the most number of industry certifications. Peter: If you ever looked at his LinkedIn page, you’ll see the entire alphabet after his name. Peter: Um, so joking aside, we’ve also got uh Brenda Ferraro who is our vice president of third party risk. Peter: She’ll be chiming in here and there uh to help out. Peter: My name is Peter Schumacher and I’ll be your webinar host for the day. Peter: I’ve got a couple of housekeeping items to to cover before we get started. Peter: So, first of all, this is a reminder that all attendee lines are muted. Peter: And we do that in an effort to cut down on background noise, especially with uh most of us working from home these days. Peter: So, uh time permitting, at the end of the hour, we do want to keep it interactive. Peter: So, we’re going to open it up for Q&A. Peter: Um during the actual presentation, if you want to type in those questions that you’ve got, please use the Zoom console. Peter: You’ll see it at the bottom of your screen. Peter: Um this webinar is being recorded. Peter: We’re going to send that recording to your inbox by tomorrow morning. Peter: Um so, uh that’s usually the most question. Peter: We are recording the the session and we’ll receive a copy of that recording. Peter: Um, I know you didn’t join today to hear me or see me, so I’m going to turn things over to Nasser. Peter: Uh, Nasser, thank you for joining us and please take it away. Nasser: Thank you, Peter. Nasser: Hey, Peter. Nasser: Will you be kind enough? Nasser: Yeah, you’re on the right slide. Nasser: So, thank you for that. Nasser: Uh, good day everyone. Nasser: Um, depending what far the world could be good morning or good evening, but hopefully you’re having a good one no matter what. Nasser: Uh, first want to thank Prevalent for giving me the opportunity to present on a topic I really enjoy. Nasser: I also want to thank the audience for taking time uh to join me today and Brenda uh for this session. Nasser: I hope uh at the end of the dialogue that you are able to at least take one or two nuggets back to the office that you can put to use. Nasser: Uh just a brief introduction and and Peter has done some of that already. Nasser: Um spent um over 20 plus years um in financial industry as well as in the healthcare industry uh working uh with executive and their teams across organizations to partake and build uh vendor risk management programs as well as well as cyber security programs that align with and support you know the business mission the goals regulatory requirements as well as initiatives that companies are looking to embark upon. Nasser: May those initiatives be uh cloud first strategy or looking to outsource critical activities with strategic vendors. Nasser: You know uh such programs may they be thirdparty risk cyber risk. Nasser: It’s always a collective effort. Nasser: Um never done as an individual effort. Nasser: Never get successful that way. Nasser: It’s always a collective effort. Nasser: Always involving key stakeholders and making sure you have the the appropriate uh executive sponsorship. Nasser: Uh now to kind of talk about third party risk management. Nasser: Uh for those of us that live this, breathe this and do this on day in day out, we we know the importance and the value uh of third party risk management. Nasser: We know the value that our vendors also known as our partners what they bring to our organizations and the reason I call vendors our partners because uh their success is our success right we we understand the importance of them succeeding in whatever we have outsourced or have uh contracted them for them to do because it’s going to generate success also to our organization. Nasser: So when we look at some of the value that our vendors bring to us you know that there’s going to be a potential cost savings because vendors may have the capability to produce something uh faster uh more economically and if not comparable quality if not better uh in comparison to what may what we may want to do internally. Nasser: Uh we also look at our vendors for innovations like cloud and it lets our organization to timely deliver more services and products to our customers. Nasser: You know what better way to uh get new customers? Nasser: What better way to retain customers uh by improving uh customer capabilities, customer experience? Nasser: Uh we also uh leverage our vendors to tap into skill sets and expertise that we may simply not have or there’s a shortage in the market that regarding those skill sets and we as I mentioned we understand the value that vendors bring when it comes to customer experience uh and then in the end basically uh vendors enabling our businesses with time to market time to deliver uh and those things are really essential for organizations right in order to generate revenue in order to continue with customer satisfaction and so forth. Nasser: On the flip side of this, because we’ve been talking about all the benefits, we also understand the risk that vendors can introduce to our organization when something goes ary, you know, that that can lead to dissatisfied customers. Nasser: That’s a biggie. Nasser: It can lead to regulatory concerns and even potential fines. Nasser: You know, the regulators uh the way they see uh outsourcing is that as a company that’s outsourcing to a vendor, we’re still accountable. Nasser: You know, you cannot outsource accountability. Nasser: You can definitely outsource that uh function that activity but that accountability stays with the organization. Nasser: So you cannot outsource accountability and rightfully so. Nasser: Uh and again when another risk uh when something goes arrive with a vendor it can be impacting our strategic goals. Nasser: Hey I am doing business with the strategic vendor because I strategically want to get from point A to point B within the next year next two years and if something goes wrong in that vendor can greatly impact our strategic goal. Nasser: Uh vendors could be failing to meet SLAs. Nasser: They can even reduce financial impact, right? Nasser: If they were to experience an operational outage, uh that can turn into monetary losses, hence we have a financial impact. Nasser: So again, these are some of the things that can go ary uh with vendors and this is why vendor risk is so important and having that visibility. Nasser: So I kind of briefly covered you know some of the advantages of why we need to do business with vendors. Nasser: I also covered some of the risks associated with vendors. Nasser: So you can see that there is a balance here when we do third-party risk. Nasser: management with risks and rewards. Nasser: And this what makes to me uh third party risk management very exciting but concurrently it can be very demanding, challenging and at times even daunting. Nasser: Uh we know that our business you know need to timely onboard their vendors because they need to time to market time to deliver but at the same time we want to make sure that’s being done in a very safe and sound manner so that we’re not incurring unnecessary risk that we don’t have to. Nasser: Uh and we talked to about on the business end within the organization also we know that risk committees management board members also want very timely and accurate visibility of the vendor risk you know how much risk do we have in our vendor portfolio does it fall within our risk risk appetite is there any vendor there that’s going to impact us strategically financially operationally those things become really important uh to risk committees board members management uh so yep you can see that there’s a plenty variety on our shoulders to keep pace with the TPRM or the third party risk management demand while concurrently we have to be very efficient and effective with our activity. Nasser: Now as you know uh as I’m describing this these challenges can become bigger uh especially when we don’t have appropriate staffing uh where we don’t have the appropriate skill set uh sometimes it has to do with vendors refusing to participate that can easily complicate the ecosystem that we have in place when it comes to how do third party risk management as well as other challenges that we’ll cover in the uh ensuing slides. Nasser: So I’m going to ask Peter to move on to the next slide. Nasser: Nope, before that one slide, the next slide before this. Nasser: Thank you. Nasser: You’re good. Nasser: Uh so on this particular slide, what I wanted to discuss was you know what is the value of thirdparty risk management and there are many values by the way uh that third-party risk management has to offer to its organization, right? Nasser: It is just not a process that people go through uh there’s a lot of value that third party risk management brings to an organization and these are some examples they’re not listed in order but I’ll provide uh some of them and I highlight them here so one of it is uh a very u efficient and effective third-party risk management program will help the businesses on board their vendors in a very timely manner but at the same time in a safe and sound manner. Nasser: So that is something that third party risk manage can bring as a service again we understand uh uh the necessity as to why our businesses want to onboard their vendors on a timely manner. Nasser: I talked about cost savings, revenue generation, uh continue to address uh customer uh experience and enhancing that customer experience and how they want to do that uh to retain uh the customer retention, acquire new customers, uh remain competitive. Nasser: All those things are really important to the business. Nasser: And again, TPRM being able to put in a vehicle that enables our businesses to do that in a timely manner, but also in a very secure manner. Nasser: I think the other area that third party risk management provides value to an organization is how do we work collectively within the TPRM ecosystem to proactively identify report and manage on risk. Nasser: So this starts from the very beginning right so if I’m involved with uh RFPs RFIs have I identified potential risk there have I identified gaps there that doesn’t align with our expectations that may be deviating from regulatory requirements. Nasser: If you happen to be in a regulated industry and when you start doing your due diligence, uh are you seeing some additional risk there all the way up to the termination process, right? Nasser: Uh before we terminate, how do we help the business terminate in a very safe and sound manner with that vendor so that it doesn’t bring our organization harm inadvertently, right? Nasser: So if you were to terminate a vendor and nobody else was involved, there might be network connections still in place. Nasser: We might be still transmitting files back and forth that contain sensitive data. Nasser: So all those things need to be orchestrated in the way of uh bringing them to um to a halt but it needs to be in a very structured manner. Nasser: So this is why you know I think third party risk management can provide that visibility you know and share that across the organization. Nasser: I also uh like the fact that you know because third party risk management has a bird’s eye view of the vendor’s portfolio uh and we know that many businesses within our organization have their own group of vendors uh they don’t necessarily may share the same vendors across the landscape. Nasser: Uh but they may have their own group of vendors and for the right reason uh keep your get that bird’s eye view. Nasser: You know, hey, is our businesses investing too much in one vendor? Nasser: Is that becoming to be a concentrated risk? Nasser: Because from a business perspective, they may not understand that. Nasser: All they know is that they have business with vendor A. Nasser: They may not realize that there’s 10 other businesses within the organization also doing uh business with vendor A. Nasser: That’s one form of concentrated risk. Nasser: Or you know, uh business A is doing all their business from A to Z with uh vendor A and that can present also uh concentrated risk and again TPRM can play a vital role here of identifying that as well as providing consolidated risk view as we know when we’re doing thirdparty risk uh we are doing due diligence and often cyber would do their cyber review business continuity would do their business continuity review privacy would do their privacy review TPRM has an opportunity of kind of aggregating that and getting the holistic risk view which you know which at times cyber may not know what are the business continuity risk and vice versa and TPM can play that vital role of saying hey you know what uh if business continuity has identified this risk what does this really mean from a cyber perspective what does it mean from a privacy perspective so it can really start to not only provide that consolidated risk view but brokering that conversation as well in the event uh people are still working within their verticals and are not working horizontally and we’ll go into that uh I think in one of the slides again TPRM can definitely make sure that the program what they have in place aligns with regulatory expectations especially if you happen to be in a regulated industry and that’s really essential uh and then uh TPRM can also provide uh inventory with tiering capabilities so it can identify to the organization u not only a central repository of where the vendors happen to be but also TPM can say we have them based on criticality and uh TPM can also help with some impact analysis. Nasser: You know, how many critical vendors we have? Nasser: What we mean by criticality? Nasser: What would happen if this vendor was to uh go u have financial troubles and wind up going bankruptcy? Nasser: Those are conversations that TPRM can bring uh the right uh brokers into those conversation to have a holistic conversation not only with the business but again uh to the board uh to the risk committees uh to the executives and so forth. Nasser: I think the other value that TPM brings is governance, oversight and reporting. Nasser: You know, what is it about that vendor portfolio that we need to inform the organization that might be risky or even everything seems to be copathetic, but we’re checking this on a monthly basis, weekly basis, whatever that cadence might be. Nasser: But that governance oversight reporting becomes really essential, especially if there happens to be a vendor that may not be meeting expectations and you need an independent lens to provide another risk perspective uh not to fault the business. Nasser: business because I’m sure the business also understand what a risk can do to that relationship but at times you know a business may not be uh in tune with a particular risk that TPRM might be able to identify and help uh not only socializing that but providing some governance some oversight and reporting. Nasser: Uh the other thing that TPRM can do is create these watch list you know uh in an organization often there are risk appetites and be able to establish these watch list because the risk appetite is is of concern with a certain vendor. Nasser: An example would be a vendor is not meeting his SLAs consistently month after month. Nasser: I’m going to put that in a watch list. Nasser: Work with the business, work with the vendor and see what is it about these SLAs’s that we can improve. Nasser: What is it about these SLAs’s that are being degraded as to why? Nasser: But those are really important uh items to put in a watch list in today’s time uh such as uh co 19. Nasser: You know, financials become really instrumental. Nasser: You know, our businesses or vendors in this case still able generate the revenue that they have in the past and they are able to take out loans. Nasser: Do they have adequate inventory? Nasser: And if there’s a concern there, you may want to put that on a watch list as well because it doesn’t meet uh your financial risk appetite as an example. Nasser: But again, TPRM can really help with that and again be able to mitigate and address those risk uh in conjunction with the respective businesses that are part of or owning that relationship. Nasser: I’m not going to cover all, but I’ll cover perhaps one more. Nasser: that I’ve seen with TPRM has been a tremendous value and that is you know avoid vendor duplication you know if I if we already have two vendor that does a whatever a happens to be and there’s a business that looking to bring in a third vendor you know why that duplicity what’s the value of that duplicity and be able to guide a business to say hey we already have two of these vendors they’re already contracted by us uh we can easily onboard them with your necessities whatever you’re looking to accomplish because they already been approved. Nasser: So that quickly expedite to that business a vendor that can do what that business is looking to do versus having to introduce a third or fourth or fifth duplicate vendor. Nasser: So that’s a tremendous value that TPRM can provide as well as TPRM can definitely help uh where there is redundancy you know how do we go about consolidating vendors so we can get better discounts how can we go consolidating contracts so we can get better discounts. Nasser: So those are some of the values that a TPM brings. Nasser: Uh to an organization. Nasser: I’m gonna ask uh Peter to move on to the next slides and then Brenda, if there’s anything else you want to chime in, please don’t be shy. Brenda: The only thing I would say is you’ve done a really great job of identifying at least 11 of the many many fundamentals and components that are required. Brenda: You you say thirdparty risk management and it may sound easy, but there’s so much to track and to monitor and to measure and what you’ve identified are discovery items that no matter what third party management program you put together. Brenda: Those are your must-have know things. Brenda: You need to know those items. Brenda: And so I think where you’re going is how do we harmonize and normalize and unify all of this together in order to make those efficiencies that you talked about. Brenda: So back to you. Nasser: Yeah. Nasser: Thanks Brenda. Nasser: And don’t be shy chiming in. Nasser: So thank you for that. Nasser: So we’re on to being effective. Nasser: And again, you know, a lot of what I’m saying is not rocket science. Nasser: It’s really common knowledge. Nasser: I’m sure you folks are aware of it, but I always like to revisit it because it’s really fundamental in in the end and if we have our fundamentals right then we have a right foundation you know I’ve always said you know you can’t build the second floor if you haven’t built the first floor so the first floor is the foundation right so uh so when we talk about being effective and again we’re talking about a third party risk management program being effective it really comes down to do we have the right people the right processes and the right technology in place and are they working in synergy to meet our intern new demands and expectations. Nasser: And bear in mind that when I’m talking about demands, I am talking about your businesses that are looking to onboard vendors. Nasser: I’m talking about your board members, your risk committees, your executives that want to understand, please tell me about my risk profile associated with my vendors all the way up to your regulators that may want to come in and see how you run your program. Nasser: Uh to some of your customers, you have B2B customers and if uh they, you know, they all understand the importance of outsourcing. Nasser: So they may come to you understand that you outsource some activities and those customers will want to understand how you run your third-party risk management program and what is it about it so that they don’t have to be concerned about things that you might be outsourcing that has to do with them and even your vendors to a large extent can also be seen as uh the people or part of your customer base right so again you know people proc knowledge becomes really important what I’m going to highlight here and then I’ll come back to people process technology is the importance of standardization and I’ll emphasize standardization you know do do we have uh questionnaires that are leveraged by all subject matter experts so is there questionnaire that privacy business continuity uh cyber security compliance so forth are we all leveraging the same questionnaire so we can provide one questionnaire to our vendors so they can answer one questionnaire right it’s very painful when we provide different types of questionnaires uh especially when they’re being sent out on different time schedule. Nasser: Because the other part of standardization is how do you schedule uh your due diligence? Nasser: How do you schedule your on-site so that the uh collective team under the third party risk management are doing this in a very cohesive fashion. Nasser: So again I talk about how do you standardize your questionnaire? Nasser: How are you standardizing your schedule? Nasser: How you standardizing your approach for critical non-critical? Nasser: You know are your criticals on-site and non-criticals tabletop? Nasser: Um when it comes to stand uh when it comes to standardization you know how doing your due diligence uh regarding those that are storing, processing and transmitting sensitive data versus those that are not right. Nasser: So, so those standardization becomes really important because ultimately what you’re looking to achieve in a very effective way by the way is a repeatable and sustainable process. Nasser: You don’t want to be creating unique approaches uh because of uh vendors that you’re looking at from day in day out. Nasser: Yes, you need to have your approach being flexible. Nasser: So, flexibility is an important thing, but it doesn’t mean that you have to always uniquely create that wheel so to speak. Nasser: It’s how do you standardize it? Nasser: How do you standardize your processes you know all the way up to what kind of evidence are you standardizing? Nasser: Are you standardizing on collection sock 2 rock report on compliance ISO certification pentest those things become really important and then taking those standardization and making sure that they fit with the other stakeholders. Nasser: So what I’m mean is that if I’m going to standardize a questionnaire is work me working with my peers from privacy business continuity, compliance, and so forth to say, “Hey, you know what? Nasser: Are your needs in this questionnaire when we’re talking about evidence collection? Nasser: How can we standardize on evidence collection so all of these folks can leverage the same evidence collection where possible?” Nasser: So, standardization becomes really important. Nasser: I would also highlight automation, right? Nasser: You know, automate, automate, automate. Nasser: And then when you’re not automating, please stop and go automate some more wherever automation lends itself to. Nasser: So, I know that, you know, When you look at verticals such as uh privacy, compliance, legal, cyber security, uh we have processes that go from A to Z and it’s important to look at those processes vertically from end to end to see what is manual. Nasser: What is it that about these process that have any value and if they have no value perhaps a consideration to be discarded, right? Nasser: They simply have no value. Nasser: But if they do have value and they happen to manual, what is it I can do to automate this process? Nasser: Because automation is going to help a lot. Nasser: It gonna uh let you focus more on the risk aspect or the risk activities when it comes to your vendor reviews, your vendor due diligence versus the administrative effort that takes place and often consumes most of our time when we are starting to do the due diligence. Nasser: Right? Nasser: So automation becomes really really important of this. Nasser: So I I talked about standardization, I talked about automation. Nasser: I kind of want to come back now to people real quickly, technology and processes. Nasser: So with people again making sure that people have the appropriate skill sets and again when you work in third parties management uh the skill sets that we bring to the table are extremely important but it constantly has to grow right so an example would be uh you’re a cyber security uh specialist you know everything about cyber security but now the business wants to go into cloud understanding what’s the relevancy of cyber security in the cloud that becomes extremely important uh your business wants to do uh business with a vendor that is doing artificial intelligence machine learning robotics RPAs. Nasser: What is it about those technology that you have to pivot from a security perspective? Nasser: No different from a privacy perspective as well. Nasser: So those are the things that when I talk about skill skill set, it’s not only having your people with the adequate skill sets in their area of expertise, but also the depth and breath based on where your business is going, based on the vendor relationship that your businesses are um doing business with. Nasser: Uh so that is the technology acument as I like to call it. Nasser: So We have the subject matter expertise acument. Nasser: That’s a technology acument. Nasser: And then the other people skill set that I will emphasize is the business acument. Nasser: You know, understanding your business. Nasser: You know, why your business operates in a certain way. Nasser: You know, what activities are relevant to your business. Nasser: Why do they perform certain functions? Nasser: So that when you’re when they’re outsourcing that, you understand it from a business perspective how to best provide your services. Nasser: Because if you’re looking at an activity that’s being outsourced and you’re only looking it from a cyber lens perspective, you may identify things that might be very concerning, but after you have a conversation with the business, you may come to the conclusion that it’s not as concerning as you thought it was because it really is not business relevant uh to that business. Nasser: Right? Nasser: So having the business acumen is really important. Nasser: So when I think of people, you know, I think of the uh theme acument. Nasser: Hey, I’m a cyber security professional. Nasser: Uh I also need to think about the technology acument. Nasser: What is it about the technology that my businesses are investing in? Nasser: doing thirdparty with so I can know how to pivot and understand uh how to do cyber security with cloud and it doesn’t have to be cyber security right it could be business continuity in the cloud it can be privacy in the cloud and then the last piece of that is the uh uh business acument uh when it comes to process what what I’ll emphasize here with process is making sure that your processes are holistic and what I mean by holistic is we like I mentioned before that we work very well vertically. Nasser: So from a cyber security perspective, we may have all our processes in place. Nasser: We may know exactly how we’re going to do a due diligence on a critical vendor, a non-critical vendor. Nasser: But I think where the biggest bang for the buck comes in is when you take uh that view and then look horizontally. Nasser: You know, what is it about uh cyber security that I can help with legal? Nasser: What is it about cyber security that I can help with procurement? Nasser: Because we’re then improving the overall process horizontally and that in the end improves the turnaround time when it comes to vendor onboarding. Nasser: So an example would be in cyber security. Nasser: I can see uh us working with the uh with the sourcing and procurement team of introducing uh security controls in the appropriate RFIs R&P RFPs so that uh when RFI RFPs comes out and if I say hey you know what uh this is uh regulated data we need to make sure that you have encryption at rest encryption in transit using that as an example that when you come back with the RFP RFI and it’s there that’s a wonderful thing because when you’re doing your due diligence which comes next you’re going to be able to leverage that information and if it’s not there you already can start having a conversation with the business and say hey you know what we have yet to onboard this vendor uh we’re still evaluating this vendor based on RFP RFI or I should say prospects in this case and these are some concerns that we already seeing and that becomes extremely insightful u to the business so again you know when I’m thinking of processes I’m thinking of you know how do we improve that horizontal end-to-end process because I think we’ve been very good vertically. Nasser: How to do things from a privacy perspective, how to do things from a cyber security perspective, how to do things from a legal perspective. Nasser: I think the opportunity now is what is it that I can do horizontally with my peers and privacy, legal, and so forth that will help us streamline all of our activities. Nasser: So, it becomes kind of a win-win situation. Nasser: In the end, you’re bringing additional value uh to the organization. Nasser: Uh on the technology piece, I I would tell you that it becomes extremely essential when we talk about technology because talking about automation, you know, uh it’ll be what I’m looking for is what can technology do for me with a high level of assurance that I don’t have to do and then let me make all the decision- making, you know, uh let the technology um collect the uh the questionnaire, let the technology evaluate, you know, what has been submitted or what has been uh agreed in the questionnaire as far as yes, I have this control and no, I don’t have those controls. Nasser: Let the technology do as much as possible doing that type of vetting, doing that type of exercise so that when I am tapping into that technology, I am looking at from a risk from a uh decision- making perspective without me having to sit there and go through all that admin activity. Nasser: Uh the other thing I look for technology is to help me uh scale, right? Nasser: So if I had x number of people manually doing uh vendor risk assessments, I’m expecting that technology to now help me scale. Nasser: Not only help me eliminate or reduce uh greatly my manual activities and and help me with the risk and decision-making process. Nasser: But I’m hoping that it can also help me scale, right? Nasser: Uh at one time, I’m only able me and my team are only able to do 10 uh due diligence or reviews per month with technology. Nasser: We should be able to do 20 or or 30. Nasser: And not only that, I can focus more on the areas of concern that provides the biggest bang for the buck uh for the organization versus again having to sit there and do all this admin, which is important. Nasser: I don’t want to trivialize that, but it takes up uh more time than the risk part of this. Nasser: Then the other piece I like about technology is how does it become a collaborative tool where I can work with my peers. Nasser: So if I’m working uh with a technology, how can I use that same technology to share uh potential gaps, potential concerns with business continuity, with privacy? Nasser: How can we start to look at each other’s activities especially risk areas that might impact my area you know where I may see something that risk has identified and say holy macro now that risk has identifi I mean other half privacy has identified that these are some security implications and vice versa. Nasser: You know, if I were to identify, hey, uh we’re not encrypting um PII for argument sakes, privacy may say that’s a concern. Nasser: It violates the following uh regulatory requirements and we can start having these very cohesive holistic synergistic conversations uh again using technology. Nasser: I’m going to ask Peter to move on to the next slide. Nasser: Thank you. Nasser: So on this slide, what I really wanted to emphasize was This is kind of what’s expected and unexpected. Nasser: And typically speaking, we build staff. Nasser: We go out and develop a team, hire resources to a large extent based on the expected. Nasser: So when you were to look at this, you kind of get to see that on the left hand side, we know we already have a workbook of X number of vendors, X number of engagements, and based on that existing workbook, we’re going to do due diligence based on whatever you have established. Nasser: You know, I’m going to do every six months my critical vendors, everyone else uh a year to two years depending on how they’re tiered. Nasser: But that’s a predictable uh factor that you can look at your resources and start mapping out your resources. Nasser: You already know uh when how many new vendors you may get uh because of either historical data or because you just have to have tribal knowledge. Nasser: You’ve been in your organization long enough and you know that on the average you have uh 20 new vendors uh per month, per quarter, per year. Nasser: You know, you know that and scope and determine how you’re going to staff that accordingly. Nasser: And you know, when you talk about uh new vendors, not only do you have to review the RFPs or the RFIs, you also have to provide scorecards and you have to help your your business with their vendor selection. Nasser: After that, uh you’re going to do your due diligence. Nasser: And after that, you’re going to do your contracts where you’re working with legal to make sure they have the appropriate terms and conditions. Nasser: If you identified any risk, you’re calling that out. Nasser: So perhaps you’re going to include that in the contract, but that’s a kind of a predictable workbook. Nasser: And that’s the left side of this under vendor management. Nasser: And then you have what I like to call the unexpected demands, but they’re just as important and sometimes they can be even riskier, right?. Nasser: So these are what we like to call event management. Nasser: So there’s a a new regulation that comes out uh that is something that you might have been bracing yourself for, but the minute it comes out and it goes into effect, you know, along the way, you have to do a gap analysis. Nasser: You have to determine, you know, how much of that gap really translates to work and if it translates to work, what does that mean when it comes to human capital? Nasser: Do I have enough people to address this gap, etc., etc. Nasser: So, those things can catch you sometimes off guard because they can be unexpected. Nasser: You can have audits and rightfully so. Nasser: They’re going to come in and review and look at your procedures, look at your practices, look at what you’ve been doing and and identify perhaps some gaps. Nasser: Those are gaps that you have not planned at one time to address. Nasser: resources to. Nasser: So that can be uh an unexpected demand. Nasser: Whenever a vendor experience an incident outage, stop what you’re doing, especially if it’s a critical vendor, right? Nasser: Stop what you’re doing. Nasser: All hands on deck. Nasser: Let’s spend time on the phone. Nasser: Let’s get into their office. Nasser: In today’s time, we can’t do that. Nasser: So, we’re going to be spending more time on Zoom or comparable uh discussing, hey, what was the incident about? Nasser: Uh why did this outage happen? Nasser: And you know, whenever there’s an incident, it’s just not one meeting. Nasser: There’s a recurring number of meetings because sometimes you vendor just informed you of an incident, but they’re still trying to figure out what caused the incident, how much data, if any, was leaked, what type of data was leaked. Nasser: So, that’s why you have these recurring meetings. Nasser: Those are unexpected demands, right? Nasser: Those are things that you didn’t expect and now is consuming some of your time, some of your resources. Nasser: I would also say, and understandably so, that there are unexpected unexpected vendor additions. Nasser: So, the business is working with a vendor, a prospect, let’s call it that, and the vendor goes, you know what? Nasser: I’m going to give you a 50% discount because it’s end of years. Nasser: That’s a wonderful situation to be in, right? Nasser: But that only means that your workbook gets thrown off because you may now have uh more uh vendor due diligence that you didn’t anticipate towards the end of the year, end of the quarter uh because there are monetary incentives to uh do business with that uh vendor. Nasser: Uh so those things can catch up guard. Nasser: And then you know the one thing I would also add is the unresponsiveness of vendors and I’m not knocking vendors so if there’s any vendors in the call please uh don’t take that as a slide I know that you folks are busy as well so no different than us being busy but you know that does add um some overhead when it comes to unexpected demands right. Nasser: Uh if a if a vendor is not responding in a week two weeks three weeks four weeks and it’s really uh an essential vendor critical vendor a vendor that we really want to do business with your business really wants to do business with uh that comes really important uh to continue to follow through and so forth. Nasser: Again, these are just examples. Nasser: This is not meant to be a holistic list. Nasser: I I kind of want to move on to the next slide, but Brenda, anything you want to add to this? Brenda: Very quickly, I like how you took the first slide before this and you talked about people process and technologies and the automation of technology with flexibility and the staffing appropriateness for the people and then the processes that modify with these demands that you’ve highlighted are basically triggers to help you know proactively what you would need to do for those three things. Brenda: So yeah, let’s move on to the next one. Brenda: You’ve got a lot to say. Nasser: Yeah, and I’m going to try I know we want to give opportunity for Q&As’s but I’m on to the next slide of what works, right? Nasser: And this again not meant to be an exhaustive list but something that I can at least share with you. Nasser: So um having uh so what works is I I already mentioned this you know staff with the right skill sets right and not only from an acument you know cyber security I know it inside out uh etc. Nasser: But I also need to know hey what is it about technology such as cloud that I need to understand so I can best apply my skill set. Nasser: What is it about the business uh acumen that I need to understand so that when I’m looking at this outsource activity I’m aligning that in a very pro in a very respective way uh with the business right because they may not see something as I see as risky as risky and when I have a conversation with the business I may come to the conclusion of the same thing. Nasser: Uh the other thing that really work works is defining accountability and who’s responsible. Nasser: And what I mean by that is literally documenting that. Nasser: Who is the entity in your organization that’s ultimately accountable for your vendor risk? Nasser: If you don’t have that documented, there’s going to be a lot of assumption is hey cyber security you identified a cyber risk. Nasser: So you’re accountable for this. Nasser: You go ahead and you meet with the vendor and you do everything from A to Z because that’s your accountability. Nasser: Hey business continuity, you identify that. Nasser: Uh I personally like to see these things really documented. Nasser: Historically, I have seen where the business that owns the relationship with the vendor being ultimately accountable for all the risk but not necessarily responsible. Nasser: What I mean by responsible is that they don’t have the subject matter expertise to kind of come in and take a look at their vendor from a cyber perspective, from a privacy perspective, from a business continuity perspective. Nasser: So, being able to leverage those subject matter experts to get anything that might represent as a risk uh to be bubbled up to the business so then the business can say, “Well, thank you for that. Nasser: And yes, the business may still ask you, I need you to partake in this conversation because I still need somebody who speaks cyber lingo to talk to the vendor cyber people so that we clearly understand what the gap is and if there’s consensus, we clearly understand what the expectation is going to be to remediate that, right? Nasser: So those things become really important. Nasser: So I I like defining in a very documented way uh a racy chart, right? Nasser: Who’s responsible, who’s accountable, who needs to be in consultant, who needs to be informed. Nasser: But over here I really highlighted accountab responsibility. Nasser: I also think what works is managed services and a lot has to do with the slide I provided previously right where in the previous slide you saw all the unexpected demands that will surface you always have to anticipate and prepare yourself for the expect for the unexpected and it’s going to happen it’s just that do you have enough uh people on the bench to react to that and this is where I think managed service provides a tremendous help also managed service can also enable for you to focus on your core competency if you just don’t have the staff side uh so that they can do that bulk of work for you and we’ll go into that uh in a few uh when we talk about processes I would highlight very clear definition is really important what constitutes a vendor so that your vendor portfolio does not have everyone under the sun because the minute you add everyone under the sun in your portfolio uh you might be subject to why you didn’t review this vendor versus that vendor. Nasser: And if you don’t have those all those criteria clearly stipulated, you may run into a jam when it comes to audit reviews. Nasser: You may run into a jam when it comes to regulatory reviews. Nasser: So I like to have very clear documented definition of what constitutes a vendor, what constitute an engagement, what constitute criticality. Nasser: Those things are really important so that when we are onboarding our vendors, we know what truly is a vendor, what type of vendors require due diligence, etc., etc. Nasser: What type of vendors need to go through the third party risk management process. Nasser: Those things become really important by definition. Nasser: Uh I’ll highlight structure real quickly. Nasser: Uh so uh the structure could be something comparable to hey uh you cannot sign a contract until you have done your due diligence because this is a vendor that requires uh due diligence. Nasser: Uh a structure like that that’s enforced is a tremendous win for the organization. Nasser: I totally understand uh businesses wanting to quickly get to the contract because contract is perhaps the longest leg when you look at onboarding a vendor followed by due diligence. Nasser: Due diligence can also be another long leg but contract from my experience has been one of the longest legs uh because of uh the ping-pong effect with redacting red lining and it’s the way contra just goes back and forth between opposing attorneys but you know structure becomes really important and that has worked. Nasser: Uh a risk-based approach I’m not going to cover all of this because I definitely want to give you time for Q&A. Nasser: A risk-based approach really works. Nasser: You know I should not be using the same measuring stick across all my vendors, especially if one is critical, one is high, one is moderate, and so forth because that doesn’t really work well. Nasser: You really want to have the appropriate measuring sticks for your critical vendors, appropriate measuring stick for your high-risisk vendor and so forth. Nasser: And that’s the risk-based approach. Nasser: The other thing that I tell you has worked is I’m not against fourth party. Nasser: So the fact that you see fourth party here is not I’m not against fourth party, but the reason I have fourth party here is that we have been able uh in places that I’ve worked at successfully work with legal to say, hey, in our contract paper, can we at least have language there that you cannot have fourth party? Nasser: And it’s not because we don’t want our vendors to not have fourth party. Nasser: Is that the minute that our vendor or prospect tells us, hey, you know what, I do have a fourth party. Nasser: I have a trigger point to be able to capture that. Nasser: Yes, I can capture fourth party through other means. Nasser: By the way, like if you uh collect sock two report and you read your SK 2 report, often it will highlight uh what other third parties your third parties are using. Nasser: losing, right? Nasser: So, you can get it from there. Nasser: But at the onstart, if if you’re not getting that from conversations, if you’re not sensing that from conversations, contractually speaking, when the vendor is about to sign on the dotted line, they want to make sure everything in that contract makes sense. Nasser: And we usually say, “Hey, no fourth party.” Nasser: And that is to trigger if there is a fourth party. Nasser: So then we can start having a fourth party dialogue. Nasser: Hey, what is it about this fourth party? Nasser: What are they going to do? Nasser: Are they going to touch our data? Nasser: Are they going to host our data? Nasser: You know, where they’re located and so forth. Nasser: When it comes to technology, I’ll quickly cover You know, if we can eliminate spreadsheets, and I totally understand, you know, why operations use spreadsheets, but if we can eliminate spreadsheets and use technology, it’s a wonderful thing. Nasser: I already talked about automation, automation and automation. Nasser: Uh how we can use technology as a collaborative tool. Nasser: How can you use technology to help you with your risk based approach? Nasser: You know, how can you use technology to help you tier your vendor, determine the inherent risk, and if you’re doing control analysis in a technology as far as what controls are effective, etc. Nasser: You can even formulate your result idual risk. Nasser: So you can decide uh how risky is that vendor when you look at all the controls and the control posture. Nasser: So technology can greatly help with that. Nasser: Technology can also enforce a structure, right? Nasser: Technology can say, “Hey, you’re going to onboard the vendor in point A and based on the vendor’s characteristics and profile, they’re going to go to due diligence.” Nasser: And they cannot go to contract for signing yet and go to contract to do any preliminary work. Nasser: That doesn’t hurt, but we just don’t want the contract signing until the due diligence complete. Nasser: And then after the due diligence complete uh legal has thumbs up if they want to sign the contract because everything that had to be done prior to the contract has kind of been enforced so to speak uh through a technology. Nasser: So technology can really help with that. Nasser: Uh and the technology can also help with the life cycle right uh I onboarded vendor on uh January 2nd and uh 2020 I need to look at that vendor again next year rather than me maintaining my own calendar technology can say hey this is a critical We said we’re going to review it every six months. Nasser: I’m going to kick off the workflow again so you can see it in your pipeline and you can go ahead and start working on uh these activities. Nasser: So technology can really help enforce your schedule and if you had a vendor that you had on your watch list as an example, uh technology can really help resurface where you need to with those watch list. Nasser: Hey, this vendor we were concerned about finance. Nasser: We’re going to track this on a monthly basis. Nasser: You can use technology to help you track that cap that information and so forth. Nasser: I think I’ve covered enough about this slide. Nasser: I want to quickly move on to the next slide. Nasser: So with this next slide, uh we’re talking about the advantages of managed service. Nasser: I want to quickly cover this because there’s another slide and then open up for questions. Nasser: So to me, when I look at managed service, I’m really looking for a partnership. Nasser: I’m not looking for somebody to do certain things for me. Nasser: That’s important and that’s probably the starting line, but I’m really looking for partnership. Nasser: I want somebody to understand what it means to be successful in my shoes and how to help me achieve that success. Nasser: And it could be with providing better customer service. Nasser: service internally where I can now onboard uh vendors for my businesses in a more timely manner. Nasser: Being able to come up with u reporting for oversight and uh risk and risk profiles and things of that nature. Nasser: So I am really looking for a partner when I talk about managed service again and I’m looking at it as how you going to help me with my day-to-day activities. Nasser: How you going to help me to be successful in very layman’s term? Nasser: And then you’re looking to see can they keep up with your volume and bear in mind that your volume may change. Nasser: You know this year You may have uh a thousand vendors u next year that may grow or your cadence may change. Nasser: You were doing critical vendor every year. Nasser: Now it becomes every six months. Nasser: That that type of volume demand is what you’re looking for your partner to be able to keep up with. Nasser: Right? Nasser: Do they have a bench that can address your immediate need? Nasser: You also want your management provider to understand industry industry best practice. Nasser: You happen to be in an industry. Nasser: A lot of industry has best practices. Nasser: You want them to understand that. Nasser: That becomes really relevant. Nasser: So If I’m in a regulated space and HIPPA and GABA and socks and all those things are really relevant to me, I want to make sure that my vendor understand the relevancy of that because when I’m looking at my vendors, I need to make sure that my vendors understand these uh regulatory requirements. Nasser: So, I’m expecting my managed service provider to do comparable if not better than me when it comes to identifying these industry best practice. Nasser: We talked about skill sets. Nasser: Not only do I want you to do cyber security, do you can you do you also understand privacy, business continuity, can also help me with these other risk areas. Nasser: You know, what’s your depth and breath when it comes to these skill sets so that I can become even more reliant on your capabilities versus me having to figure out I need to split this activity between my manag service provider and myself because that becomes a pain right if I am going to outsource an activity and subscribe to managed service again I’m already looking at the partnership and I’m looking for them to be able to bring this kind of value upfront and to me having these boards skill sets become extremely value. Nasser: Hey, help me on risk focus. Nasser: You know, what is it about my risk that I need to be aware of? Nasser: Uh can you consolidate these risks? Nasser: Can you present me in a dashboard? Nasser: Can you show me how this risk is a concern now in in three months, six months? Nasser: That would help. Nasser: I’m not asking my mass service provider, by the way, to make risk decisions for me. Nasser: That’s my job, right? Nasser: Again, I cannot outsource that accountability, but I can definitely help them have them help me identify where they’re seeing risk. Nasser: Help me I identify where there’s potential uh risk reduction and things of that nature right but again uh when it comes to risk when it comes to risk reduction they are helping identify those things and they can even help with the conversation piece but I go back to that accountability that I described earlier you know in this particular example that I provided you know the business owns a relationship they own these risks this would help me to bring these risks to the business and have a constructive conversation by saying hey these are the risks we have identified. Nasser: And if you treat it in such and such fashion, this is how we’re going to reduce this risk to an acceptable level in the organization. Nasser: If I talked about technology and automation before, I’m expecting the same for my managed service provider. Nasser: So, I’m not going to emphasize that because I already told you how important that is to me. Nasser: And yes, cost savings where uh is an area that I will look at, but you notice that I didn’t mention cost savings first. Nasser: I’m expecting value, value, value, and then cost savings towards the end because it’s about that partnership. Nasser: Can you keep up with my volume? Nasser: Uh do you understand best practices, do you have the right skill sets? Nasser: Can you help me identify risk, reduce risk, do you have technology capabilities? Nasser: Those things are really essential because if a management provider were to come in and say, “Hey, I’m going to charge you a dollar per due diligence and they’re doing this very manually and it takes them nine months to finish one due diligence.” Nasser: That is not a partnership. Nasser: So, this is why I don’t go into cost savings immediately. Nasser: I’m going to go to the next slide because I think we only have 10 minutes left. Nasser: So, this is the wrap-up. Nasser: slide right and when selecting a man service provider I already told you you know some of the things that we should be looking at but again uh industry tenure how much experience you have are you a reputable vendor in the industry that becomes really important because you want to make sure that when your management is asking you who are you partnering with why you’re partnering with them this is the credibility piece right this is the piece that you can go back and say nope these people know what they’re doing they have the experience in the industry, they’re reputable. Nasser: That is an important conversation to anticipate. Nasser: Uh when you go to your manager and you’re talking about, hey, either I’m going to outsource my third party due diligence for my moderates or non-criticals or I’m going to outsource whatever you’re doing. Nasser: Uh expect your manager or management team to kind of come back and say, you know, what is the value we getting out of this? Nasser: And then how can you ensure that we’re going to get the value or the bang for the buck? Nasser: And that first bullet point is really important. Nasser: You definitely want uh flexible fee structure because what you’re going to realize and we all know this uh you may have uh a due diligence where you can complete it from A to Z or you may have a due diligence where you can only complete it from A to B because you’re just not getting the cooperation or the business has decided in the last minute you know what I’m not going to go with that vendor but you’re already kicked off you already created a workbook right so you want to understand hey you know what these are my scenarios in the office. Nasser: You know, there are times I completed due diligence. Nasser: There’s times I’m going to do a partial due diligence and there are times I’m going to do a due diligence and not necessarily complete it because the business decided the last minute to change their mind. Nasser: So those things exist in your environment. Nasser: So you want to understand uh hey partner when we talk about these scenarios, how are you billing me with this? Nasser: You know, do you have flexible fee structure? Nasser: So that’s an important uh aspect of in your vendor selection process when you talk about managed services. Nasser: Uh we talked about a proven track record, but I want to quickly talk about SLA. Nasser: you know, make sure you understand that there are, you know, what SLAs’s and what those SLA really means from a business uh turnaround perspective and what the relevance of those SLAs’s are to you. Nasser: Uh regulatory requirement understandable. Nasser: You know, if you’re in the regulatory space, you want them to be regulatory savvy. Nasser: You want them to understand regulations. Nasser: Uh you also want their solutions, you want them as partners to understand also your policies and standards, right? Nasser: Because whatever policies and standards you have internally are also applicable to your parties. Nasser: So if I’m going to do business with vendor A and I’m going to outsource this function, those policy and standards I have in my organizations are just as applicable to that vendor just outsource that activity. Nasser: That is no different than your managed service provider understanding that and also applying that. Nasser: So not only from a regulatory perspective when they’re doing the due diligence, but hey Nasser, I know you have policy, you have standards, let us understand what those policy and standards are when we’re looking at regulatory data, when we’re looking at PII, because that needs to continue to be in effect when we’re doing uh due diligence of a vendor that we’re looking to onboard. Nasser: We talked about uh subject matter expertise and again having the bench so that uh you can rely on yep privacy, business continuity, uh cyber security, you know what those strengths are and as well as my demand has changed from this month to next month. Nasser: Can you keep up with that demand? Nasser: That becomes really important. Nasser: I talked about some of the examples of uh end of year incentives that I have been in involved with historically where the business comes up to me and say, “Hey, Nasser, I I know your SLA is X number of days. Nasser: Can you cut that in half because I have such a great incentive? Nasser: I’m going to get these uh this this wonderful contract with the right numbers and I’m there to help the business.” Nasser: So, I’ll do everything possible to help my business be successful in a safe and sound manner. Nasser: So, again, uh in those cases, in those scenarios, whatever you experience is very important that you’re having that conversation. Nasser: with your managed service providers so that they can make you win in those situations. Nasser: Remember what I said, you know, they’re there to help you, but in the end to make you successful. Nasser: And I really do mean that, right? Nasser: And it’s not because I’m I’m being u egotistical is that if they can’t make me successful, then I’m falling short somewhere. Nasser: Um ability to work at all levels. Nasser: So I think we cover that. Nasser: And then you know having really good reporting and dashboard. Nasser: I think that’s really relevant because at times you’re not going to be able to talk to your manage provider every hour every day. Nasser: But you definitely like to go to a dashboard and say you know what is the pipeline healthy? Nasser: Are they uh pushing out doing what they’re supposed to do as per the SLA? Nasser: Those things become really relevant right so that is something that I would tell you uh you should be looking for when you’re looking at master provider. Nasser: Again everything that we discuss here is not meant to be an exhaustive list but I’m hoping that I’m hitting some of the high marks so that again uh you can you can be able to take full advantage of what’s here and there’s anything else I can help you with, you know, you can always reach out to me. Nasser: I’m available on LinkedIn. Nasser: Uh, Brenda, I’m sure she’s available as well. Nasser: But, uh, I’m going to pause here because I definitely have five minutes for Q&A. Nasser: So, anything else you want to say, Linda, and I think we already have one question. Brenda: Uh, no. Brenda: I want to let us have the question and answer time. Brenda: So, Peter, I take it over to you for the polling question and then to ask the questions that you have. Peter: Thank you. Peter: Uh, thanks Brenda. Peter: Thanks, Nasser. Peter: So, we do have some questions in the queue. Peter: Um, well, first of all, I threw up a polling question. Peter: Uh, it should show up on your screen. Peter: Are you looking to augment or establish a third party risk program in the next several months? Peter: So, yes, no, or you’re not sure. Peter: So, we’d appreciate uh an answer on that one. Peter: Thank you. Peter: Um, so let’s get right to questions. Peter: The first one here in the queue is, what is best practice for gathering financial information? Peter: Uh, private companies may not provide 2020 financials due to COVID disruption. Peter: Uh, 2019 financials may not be relevant to the the actual real risks. Nasser: I’ll take a jab at this and I’ll give it over to Brund. Nasser: So I I would tell you uh totally understand the challenge with private companies and financial reporting. Nasser: They don’t have the same obligation as a public company. Nasser: Uh and at the same time uh as you stated you know co 19 can definitely delay if they’re going to generate any reporting which they will um can definitely delay the the timing of that report. Nasser: What I have seen is a couple of things. Nasser: Uh one three things I would say. Nasser: One is make sure that when you onboard you taking advantage of it at that juncture. Nasser: I’ll say four things now that popping in my head. Nasser: Take advantage of when you’re first building that relationship the relevancy of getting financial reports and if you have to pop it into the contract. Nasser: We would need your financial report every six months, every quarter, every year, whatever you think that cadence is right depending on how significant that vendor is to you. Nasser: So, uh that’s one. Nasser: The second thing is there are some vendors in the industries that can help with this where they do work on your behalf. Nasser: Uh uh and they have been able to successfully work with your vendors, your private vendors uh to be able to get financials and a lot is because there’s a win-win situation there. Nasser: But there is uh vendors in the industry that can help with that. Nasser: Uh so I thought I I think I mentioned three things. Nasser: One is do it on the onset. Nasser: Uh if it’s that relevant to you, uh make sure that you have it in your contract. Nasser: Third, you can definitely work with some uh independent entities that does this for you. Nasser: And then the fourth thing that I meant to include was if If you’re building relationship and you have those healthy relationship, uh asking for those financial should not be a surprise because that is something that one should be doing often especially in the time of COVID uh when it comes to relationship building and having those relationships in place. Brenda: I’m not going to comment on that outside the fact that there are tools like you said or solutions that can give you private and public information on financials. Brenda: So go ahead and uh send an information inquiry to info prevalent and we can try to help you in that space. Brenda: But on to the next question, Peter. Peter: Okay. Peter: Uh time for maybe one more. Peter: What are some of the metrics that are used for your vendor risk management uh when reporting to the board? Nasser: Yeah. Nasser: So, I’m going to cover some quick ones and then I’ll give it to Brenda because I know she’s seen it uh across her customer landscape. Nasser: So, I would tell you uh vendor criticality. Nasser: Hey, how many of our vendors are are critical? Nasser: Uh so, that’s uh one. Nasser: Uh also, uh any vendors that are off the risk appetite uh organizations have risk appetite you know so you may have a financial risk appetite cy have a security risk appetite so any risk appetites that are way off I can see that as metrics uh internally. Nasser: Um I have seen uh metrics for time to onboard vendor uh time to terminate vendor I’ve seen those types of metrics as well but as far as the the board goes you know I go back to um critical anything that can impact uh the organization uh strategy, financial, operational, uh those kinds of uh risk and uh I forgot what the third one was, but uh Brenda, I just want to give it to you. Brenda: Yeah, sure. Brenda: The things that I’ve seen um very effective is also in line with what Nasser said, top riskiest domains. Brenda: So, what are the different domains that are causing the most problems across your portfolio? Brenda: The top riskiest vendors. Brenda: So, who are those vendors that might cause you problems from a qualitative or a quantitative or economic perspective, trends on risk mitigation closure or um if you’re having to transfer that risk. Brenda: And then finally, the intelligence on supply chain resiliency is becoming one of the top things that the boards want to know. Brenda: Are there any vendors that are going to cause us economic impact based on the fact that they can’t provide either the um the service or the product or the data exposure um protection? Peter: Great. Peter: Thank you. Peter: Uh looks like we’re at the top of the hour. Peter: If you don’t mind, Brenda and Nasser, just scan through the remaining questions and see if there’s anything that’s a oneline answer. Peter: Um if not, we will give everyone uh the rest of their day. Nasser: I didn’t see any. Nasser: Although I see some good questions, but definitely not oneliner. Peter: Yeah, exactly. Peter: Okay, so we’ll uh I’ll take those questions. Peter: We’ll see if you can get some answers offline, but appreciate the engagement. Peter: And Nasser, thank you so much for this. Peter: This is very helpful. Peter: Uh Brenda, thanks for chiming in as always and everyone enjoy the rest of your day and we’ll see you on the next webinar. Peter: Thank you. Nasser: Take care folks.