Third-Party Risk Management (TPRM) - start here

Previously delivered this presentation at AISA WA Branch Meeting (over 50 attendees).

Things to consider before, during, and after your Third Party Risk Management (TPRM) initiative.

Listen to battle stories, and lessons learned across a diverse set of sectors establishing a Third Party Risk Management function.

You will leave with insights and a practical approach to planning and governing your Third Party Risk Management (TPRM) program.

We will touch on the following to give the audience valuable insights from the front line:

- Identifying key stakeholders up front (i.e. procurement/supply team, finance team, or other central point that most suppliers will go through for on-boarding)

- Understanding what your organisation cares about, to construct a short triage questionnaire (>10 questions touching on CIA triad, capturing scope of service/product, and data classification)

- Discuss change management methodology to aid adoption (ADKAR)

- Tiering your vendors (High/Med/Low risk)

- More information about questionnaires, and frequency of reassessment to be effective

- Risk registers, and tips to ensure Cyber risk mitigation actions are not ignored (Unpack example of leveraging existing risk registers/tools the business is already familiar with such as Health and Safety risk registers to assign Cyber actions)

- (optional) Touch on free tools on the market to assist with initial review (i.e. LokuSec Security Rating Platform - SRP - https://www.lokusec.com/security-ratings/

- (optional) Touch on paid tools for TPRM (i.e. UpGuard)