Effective Handling of Third-Party Supplier Incidents
summary
Advocates a concrete process: inventory critical vendors, bind SLAs in contracts, and use tooling that combines contracts, questionnaires and risk scores to prioritize remediation. Cites a Prevalent stat: 61% of organizations saw breaches, a 49% increase. Triggers include threat-intel continuous monitoring that feeds a two-step triage, immediate reactive vendor SAQ, and a severity matrix (P1/P2) that invokes a supply chain risk management committee to approve containment, remediation plans and formal risk-acceptance signoffs.
AI-written summary · about
chapters (19)
- 0:00Introduction and setup
- 1:49About the speaker and topic
- 3:13Agenda and problem statement
- 5:18Responsibility for third-party incidents
- 7:04Role of supply chain management
- 8:52Third-party risk management team
- 11:45Supplier risk assessments and tooling
- 13:49Developing IR runbooks
- 15:58Threat intelligence and triage
- 17:21Incident analysis and vendor SAQ
- 19:05Business relationship officer role
- 21:18Containment controls and risk acceptance
- 23:07Supply chain risk management committee
- 25:35Decision flow for containment
- 27:40Risk-based decision criteria
- 28:21Vendor non-response handling
- 29:25Communication protocols
- 30:08Recovery and post-incident steps
- 31:15Key takeaways and closing
related talks
47mManaging Vendor Incidents
36mSupplier Risk Where OSS Collides With Vendor Management
40mA Punch to the Supply Chain: Fighting Back to Resilience
48mRemaining Resilient in the Supply Chainpocalypse
29mVendor Security: Where Our Data Goes We Follow
56mSupply Chain Threats Deserve Their Own Incident Response Plan
44mCybersecurity - Protecting the Organisation's Technological Assets
51mThe Overlooked Security Risk: 3rd Party Risk Management