GDS presentation and discussion on “Managing Third-Party Risk in an Interconnected Digital Ecosystem.”
Third-party risk is no longer a security problem we hand to vendors. It is an enterprise risk we manage through governance, contracts and relationships. The organizations getting it right start inside their own walls.
That was the case I made in my recent session. Every vendor, platform and subcontractor that touches the organization’s data extends an attack surface we do not own and cannot fully see. The firewall no longer marks where our responsibility ends.
Unpacking the 3 part series from my presentation in part 1, what the room added in part 2, and where peers reinforced the position, where they extended it, and where emphasis wrangled.
Part 1: What I Spoke To
1. Make Third-Party Risk Management (TPRM) an enterprise program, not a security function
Third-party risk belongs in enterprise risk management. That starts with a clear risk appetite statement, tied to security maturity and a deliberate path toward that target state.
It also means a unified process not a disconnected flow. Procurement, legal, privacy, risk and insurance, IT, and security must work together, with stakeholders defined by what data is shared or accessed. Procurement should route through security and other stakeholders from the start and not at signature.
2. Get your own house in order first
You cannot assess others successfully until you know what you have. That means an inventory of data, flows, and ownership, up and down the stack. Strong internal data governance and asset management are the fundamentals to making external assessments meaningful.
The biggest gap I hear across the industry is visibility into third as well as fourth parties. We don't know what we don't know.
3. Tiering matters but execution is equally essential
No tiering model is universal. Whatever you choose must be applied consistently and weighted by data sensitivity and business criticality.
Let risk appetite set the monitoring model: continuous for critical vendors, point-in-time for the rest, and invest in detection as much as prevention.
4. The contract is your strongest initial control
Standard templates should cover transparency, incident notification, breach protocols with real playbook detail, fourth-party disclosure, and best if formulated with credits and penalties.
Build in triggers for material change, such as a vendor acquisition or a new initiative. Given the pace of AI, favor shorter terms and require disclosure of AI use and modeling, including by subcontractors.
5. The new perimeter is relationship and trust
Tools are only as good as the people and partnerships behind them. Still, tools, including AI, improve visibility, guardrails and protection, and we should use them.
A vendor's culture and how it operates tell you as much as its questionnaire does. Partnerships that align with matching culture establishes the best relationships.
6. AI is multiplying dependencies
We are moving beyond traditional vendors into AI-enabled services, external models, plugins, and autonomous agents. Vendor-embedded AI can introduce new data flows. Agents can hold identities, permissions and access to enterprise systems. Model providers and subprocessors create downstream dependencies that annual reviews may miss.
We cannot govern what we cannot see. But visibility alone is not enough because we must also challenge what our assessments actually prove.
7. Design for failure, not just prevention
We cannot eliminate every third-party failure but we can limit how far it spreads and how long it affects the business. That requires defined isolation and containment procedures, tested recovery and continuity arrangements, clear incident decision rights, and exit plans for single-provider dependencies.
Resilience is proven through tested capability, not documented intent. This is where third-party risk becomes an enterprise leadership responsibility.
What's holding us back
Limited team size, time/speed and budget. Competing priorities and limited visibility add to the dependency and complexity. One practical lever often overlooked is reducing the data you share. Less data shared means less exposure to manage.
Emerging pressures
AI guardrails, vendor M&A, cyber insurance requirements and the limits of cloud isolation are all reshaping the landscape. Gateways can help segment higher-risk connections.
Part 2: Discussion Portion - What Was Heard
The room largely supported the position. Peers added operational texture, extended the governance model and offered one meaningful difference in emphasis.
Where the audience reinforced the position
• Asset management is foundational. Peers stressed that the attack surface changes continuously. Asset management cannot be a one-time inventory but instead kept pace of change.
• Detection and protection both matter. The audience echoed that both must be emphasized, not one at the expense of the other.
• Resources set the ceiling. Peers noted that team size and investment are directly proportional to the intensity and comprehensiveness of assessments. They also reported rising demand in both the volume and complexity of assessments, with time pressure compounding the strain.
Where the audience extended the position
• Accountability at the top. One model shared had the risk department leading third-party engagement and accountability, with the CEO and other executives signing to engage third parties and signing off on all accepted risks. This puts real teeth behind anchoring TPRM in ERM.
• A clarification on ownership. I advocated the partnership with procurement through security and key stakeholders from the start, places ownership with risk decision making. These are complementary, not competing: security informs early, Risk owns the process, and executives accept the residual risk.
Where emphasis differed
• Insurance as a lever, not just a pressure. I framed insurance as an emerging pressure, driven by carrier requirements. The audience framed it as a strategic tool for risk transfer, one that should be a strong position, with coverage levels and limits adjusted as vendor exposure changes. Both views hold. The practical takeaway is to keep insurance top of the TPRM process so coverage tracks the actual third-party risk profile.
Part 3: In Closing - The Call to Action
Start internally by defining and socializing your organization’s enterprise risk appetite. Know your data, the flow, your vendors and the AI they bring with them. Put your expectations in the contract, keep insurance aligned with the risk you actually carry, and test how you would respond when a critical provider fails.
The room confirmed what I see across the industry: the challenge is less about knowing what to do and more about the capacity to do it consistently. That makes governance, executive accountability, data minimization, and rehearsed resilience even more important.
Vendors will meet the standard you set but only if you set it. Afterall, it’s about partnership and relationships that move us all forward.
Thank you GDS, my co-host and everyone who all attended and contributed thoughtful perspectives to the discussion. Your engagement and insights were greatly appreciated.
No comments:
Post a Comment