Third-Party Risk Management Overview

Introduction to Third-Party Risk Management

In an environment where third parties are intricately woven into day-to-day operations, increasing risk visibility across the extended enterprise is essential. Each day, companies experience new security, privacy, compliance, and operational resilience challenges related to their third parties. A strong vendor risk stance is important to ensure compliance, which helps maintain a resilient, secure, and scalable third-party ecosystem.

Third-Party Risk Management (TPRM) is the process by which organizations effectively oversee and manage the risks posed by external entities that provide goods, services, or perform business functions on behalf of an organization. These external entities, often referred to as third parties, can include:

  • Vendors

  • Suppliers

  • Contractors

  • Consultants

  • Partners

  • Outsourcing providers

  • Other business associates

The primary objective of TPRM is to ensure that the activities and operations of external entities align an organization's goals, risk tolerance, and compliance requirements. To achieve this primary objective, organizations need a personalized and systematic approach to selecting and onboarding. They also need methods to successfully identify, mitigate, and monitor risks associated with third parties throughout the duration of their engagement.

OneTrust’s TPRM module helps streamline the third-party risk management life cycle from onboarding to offboarding. The module enables a risk-based approach to TPRM to help eliminate manual work by:

  • Providing templates for common privacy and security frameworks and flexible, user-configurable workflows that can be easily tailored to fit the unique needs of your organization

  • Supporting data-driven automation across the third-party lifecycle

Third-Party Risk Management is part of the GRC & Security Assurance cloud with OneTrust. To learn more, see the Third-Party Risk Management knowledge base.

Note:

For a demo on Third-Party Risk Management, watch the video here.

TPRM Module Benefits:

The TPRM module can help your organization:

  • Establish and manage a comprehensive inventory of third-party relationships and associated assets within your organization

  • Automate vendor assessments

  • Generate risks through vendor workflows

  • Ensure information is up-to-date and accurate through automation rules

  • Mitigate third-party risks by selecting from existing controls tied to well-known frameworks or customize based on your own framework

  • Choose from a curated gallery of assessment templates based on industry laws, standards and frameworks

Problems Solved by Third-Party Risk Management:

Lack of Third-Party Risk Visibility

: Centralize and streamline the management of vendor relationships to help minimize risks through comprehensive oversight.

Resource Intensive Processes

: Implement automated processes for conducting initial assessments and periodic re-assessments to help reduce the burden of manual evaluation tasks.

Compliance Evaluation

: Access a diverse repository of pre-established assessments derived from up-to-date legal requirements and industry frameworks to help facilitate efficient and accurate compliance assessments.

Risk Mitigation

: Associate relevant controls sourced from our extensive framework library with identified risks to help enhance the effectiveness of risk management strategies and ensuring proactive mitigation measures are in place.

Typical Users

Administrators or key users of Third-Party Risk Management would report to or have the following titles:

  • Chief Information Officer

  • Chief Risk Officer

  • Chief Procurement Officer

  • Chief Compliance Officer

  • Chief Ethics & Compliance Officer

Framework Examples

OneTrust’s Third-Party Risk Management solution helps organizations fulfill the requirements to comply with many frameworks and certifications. 

Popular security and privacy frameworks that Third-Party Risk Management can help with are listed in the table below:

Framework

Framework Description

SOC 2

SOC 2 is a reporting framework designed to help companies assess their policies and controls for security, privacy, confidentiality, availability, and processing integrity. SOC 2 is the most requested InfoSec framework and audit process in the US because it signifies that an organization can be trusted to secure its customers and sensitive data. To obtain SOC 2 compliance, organizations need to implement security controls that assess and manage the risks associated with their vendors.

Note:

To learn more about the SOC2 Framework, read our blog post here.

ISO 27001

ISO 27001 is a flexible standard, allowing organizations or service providers to determine the scope of its information security management system (ISMS). The ISMS encompasses all the applications, systems, processes, and people your organization needs to protect. There are Annex A security controls related to vendor management.

Note:

To learn more about the ISO 27001 Framework, read our blog post here.

GDPR

The GDPR is the strongest global privacy law in effect today. It was created by the European Union (EU) to regulate how organizations collect, handle, and protect personal data of EU residents. It defines eight data subject rights that guarantee specific entitlements for individual’s personal data. Ultimately, it gives individuals more autonomy over their personal information and how it is used. The GDPR holds the controller responsible for actions or breaches by the processor. Third-Party Risk Management helps review and remediate processor risks, as outlined in GDPR Articles 28, 24, 29 and 46.

Note:

To learn more about the GDPR Framework, read our blog post here.

CCPA

CCPA compliance means that covered businesses – for-profit entities that fall under the scope of the CCPA can demonstrably meet obligations set out under the CCPA, which includes a range of new consumer rights, a new definition of personal information, and new concepts of businesses and service providers in relation to the roles of controller and processor. Managing your vendors with Third-Party Risk Management helps ensure your organization is performing its obligations with CCPA consumer rights.

Note:

To learn more about the CCPA Framework, read our blog post here

TPRM's Relationship to the OneTrust

Third-Party Risk Management can integrate with other OneTrust modules to enable enhanced features:

Third Party Risk Exchange

: Populate vendor profiles with firmographic, cybersecurity, compliance, financial, operational and ESG data points as well as sign up for breach, adverse media and SEC disclosure notifications

Data Mapping Automation

: Pull in vendor records, then link risks and assessments to help understand the full scope of the data map in relation to the flow of data, processing activities and other relationship types

IT & Security Risk Management (ITRM)

: Pull in vendor records, then link risks and assessments to drive deeper vendor evaluations tied to your overall GRC program

Third-Party Due Diligence

: Screen and monitor third-parties and linked entities for information such as: adverse media, sanctions list, anti-bribery, anti-slavery, etc. to flag risks and drive automated workflows to assessments