1. Third-party risk management (TPRM)
An ITC managed security service

2. 65% 94% 83% Market conditions of breaches linked to third parties
plan to spend more over next 12 months
83%
of business leaders lack confidence
Organisations are experiencing a growth in third-party associated cyber security risks
…meaning a greater focus on third-party related governance and reporting
…however, traditional TPRM programmes are resource intensive, complex and error prone.

3. Organisations need a way to translate and distil this cyber activity into meaningful information so they can identify key risks and create effective TPRM programmes.

4. Market conditions
Cyber Security ratings provide a quantifiable correlation to third-party risk and data breaches: 5x
more likely if your rating is below 400, than one above 700 3x
more likely if 50% of your computers are running updated OS 2x
Open Port risk vector grade is F
But they require considerable effort to administer effectively, at a time when companies often have resource shortages and skills gaps.

5. Our TPRM solution
A fully managed service that helps organisations measure, manage and reduce their exposure to third-party cyber risk.
Providing continuous monitoring of third parties, using an industry recognised scoring system to identify where risk is highest.
Giving clear guidance to enable productive interactions with third parties where risks exist, how they should be mitigated to ensure quick resolution for reduced cyber risk exposure.

6. Why you need it
Whether managing a number of third-party vendors, potential new clients, new partner or acquisitions, continuous visibility of their security performance is critical.
Poorly rated third parties carry a significantly higher risk (up to 5X) of cyber breach, understanding and mitigating this risk to your own business is a key business imperative.

7. The solution – three components
ITC TPRM managed service
1. Setup and onboarding
Monitoring and alerting
Regular monthly reporting
Expert cyber security knowledge to help you translate and distil all cyber activity and data into a tailored and actionable programme where the customer can identify, measure, and continuously monitor risk.
Establish rules of engagement, standardised scoring, service processes (internal and external RACI) and governance policies around monitoring activities and thresholds.

8. The solution – three components
ITC TPRM managed service
1. Setup and onboarding
2. Monitoring and alerting
Regular monthly reporting
Continuous monitoring of identified critical third parties, by a expert cyber analyst.
Daily Event alerts indicating significant third-party profile and risk changes, including recommended remediation actions to enable easy collaboration with affected third party.
Updated status for critical third-party remediation actions within the current month to enable vendor follow-up.

9. The solution – three components
ITC TPRM managed service
1. Setup and onboarding
2. Monitoring and alerting
3. Regular monthly reporting
Monthly performance reporting and trend analysis highlighting overall third-party and risk posture, industry trends, benchmarking, and threat activity.
Deep-dive analysis on any flagged ‘at risk’ third-parties.
Monthly de-brief call with a cyber analyst.
Annual programme review and refinement workshop.

10. The solution – key features
ITC TPRM managed service
Setup and onboarding
Initial TP Risk Assessment Report – overview of identified priority risk vendor rating performance, review of current framework, and guidance on how rating and alert data could integrate into these processes and policies
Onboarding Workshop informed by report to identify and agree vendor categorisation / risk tolerance, initial remediation guidance, definition of service processes (RACI), and set alerting thresholds and preferences
Monitoring and alerting
Continuous monitoring
Daily alerts based on:
Rating, and risk vectors changes
Infections, vulnerabilities and breaches
Full details and remediation guidance
Alert Status Tracker: updated status to track evidence of remediation
Triaged and sent via in password protected .pdf
On-demand cyber expert support 2hours month
Annual programme review and refinement workshop
Regular monthly reporting
Vendor Performance overview of monitored vendors, by score rating and risk changes
Trend analysis / vendor deep-dive
Significant rating / grades drops
Performance vs benchmarks
Summary of infections, vulnerabilities, breaches, by affected vendors
Remediation and alerts status summary
Benchmark insights (ratings vs industry)
ed password protected .pdf
De-brief call – Q&A, threshold refinement

11. Benefits of our solution
Expert advice for best practice set up, monitoring, and management of third-party risk
Alerts backed by professional analysis for improved risk insight
Effective remediation guidance to reduce the risk of breaches and facilitate easy vendor engagement
Tracking and trend information to monitor individual companies
Peer-based benchmarking