The Overlooked Security Risk: 3rd Party Risk Management
summary
Covers a full vendor lifecycle with concrete steps: governance, scoping, questionnaires, contract negotiation, ongoing monitoring and termination, plus Microsoft Teams + Excel macros demo that auto-populates questionnaires, downloads responses, auto-scores findings and generates PDF scorecards. Recommends a ten-area questionnaire (asset, vuln management, IAM, incident response, etc.), consistent risk acceptance form and numeric risk scoring to gate approvals. Also explains reverse TPRM (customers sending questionnaires) and using certifications like ISO 27001 to reduce response burden.
AI-written summary · about
chapters (18)
- 0:00Introduction
- 3:05About Rose
- 5:23What are third parties
- 7:05What is 3rd party risk management
- 9:10The vendor life cycle
- 16:30Scope
- 18:40Risk Assessment
- 28:05Remediation
- 28:57Documentation
- 31:50Scorecard
- 33:27Vendor Life Cycle
- 34:20Making it easier for myself
- 35:16Automation
- 36:34Ideas
- 37:44Demo
- 40:15Excel Spreadsheet
- 43:20Questionnaire
- 47:18Score Card
related talks
51mYour Third-Party Risk Management Program Is Bad and You Should Feel Bad
27mThird-party Risk Management: SOC 2s, Security Questionnaires...
53mYou Gotta Fight For Your Right To Third Party
35mEffective Handling of Third-Party Supplier Incidents
44mCybersecurity - Protecting the Organisation's Technological Assets
08mMaximizing Security and Compliance through Digital Third Party Risk Management
36mNot Your Mama's Risk Assessment
45mBringing the Dawn of Security & Compliance to Project Teams