Third-Party Risk Exchange Overview

Introduction to Third-Party Risk Exchange

Third parties can present risks that can have negative impacts on your organization. Risks can include: data breaches, reputational damage, regulatory violations, or financial losses.

Manually assessing and monitoring these risks is a complex, time consuming, and resource-intensive effort that can also leave your organization with significant gaps in risk visibility across your third-party ecosystem. The Third-Party Risk Exchange, often referred to as the Exchange, fills these gaps by surfacing continuous risk insights about your third parties.

The Third-Party Risk Exchange works by bringing together real-time data feeds from leading risk intelligence providers into a single dashboard. Then, it displays more than a dozen data points on each third party. This centralized view enables greater risk-informed decisions, and provides granular details across risk domains, including: financials, operations, compliance, ethics, ESG, privacy, cybersecurity, and more.

The risk intelligence data the Exchange provides enables you to continuously monitor your extended enterprise between assessments, and can be used as a baseline to tailor the depth of third-party risk assessments. You can use this data to focus on the most critical risks.

Additionally, the Exchange actively listens for data and scoring changes and can automatically trigger intervention workflows, which allows you to take immediate action without manual monitoring.

Third-Party Risk Exchange is part of the GRC & Security Assurance cloud with OneTrust. To learn more, see the Third-Party Risk Exchange knowledge base.

Module Benefits:

  • Gain access to risk data from Security Scorecard, Risk Recon, and HackNotice.

    Note:

    OneTrust may also include scores from other suppliers.

  • Monitor your third parties for data breaches and regulatory enforcement actions

Problems Solved by Third-Party Risk Exchange:

Save Time by Leveraging Risk Intelligence Data

: Use out-of-the-box data to make risk-informed decisions on the depth of third-party assessments and requirements for ongoing monitoring.

Automate Actions as Risks Arise with Workflow Automation Triggers

: Configure workflows that use the data as automation triggers, enabling you to take immediate action without manual intervention, such as flagging a risk, notifying key stakeholders, or sending a reassessment.

Typical Users

Administrators or key users of Third-Party Risk Exchange would report to or have the following titles:

  • Chief Information Officer

  • Chief Risk Officer

  • Chief Compliance Officer

  • Chief Ethics & Compliance Officer

Framework Examples

OneTrust’s Third-Party Risk Exchange solution helps organizations fulfill the requirements to comply with many frameworks and certifications. 

Popular security and privacy frameworks that Third-Party Risk Exchange can help with are listed in the table below:

Framework

Framework Description

SOC 2

SOC 2 is a reporting framework designed to help companies assess their policies and controls for security, privacy, confidentiality, availability, and processing integrity. SOC 2 is the most requested InfoSec framework and audit process in the US because it signifies that an organization can be trusted to secure its customers and sensitive data. To obtain SOC 2 compliance, organizations need to implement security controls that assess and manage the risks associated with their vendors.

Note:

To learn more about the SOC2 Framework, read our blog post here.

ISO 27001

ISO 27001 is a flexible standard, allowing organizations or service providers to determine the scope of its information security management system (ISMS). The ISMS encompasses all the applications, systems, processes, and people your organization needs to protect. There are Annex A security controls related to vendor management.

Note:

To learn more about the ISO 27001 Framework, read our blog post here.