Risk Management for Cyber Security Managers - Steps to Implement TPCRM

The video tutorial outlines the steps for implementing Third Party Cyber Risk Management (TPCRM). It begins with identifying all vendors, focusing on those with access to important data. The next step involves evaluating inherent risk, which is faster than assessing residual risk. Once vendors are classified by inherent risk, residual risk is assessed using questionnaires, considering compliance standards. The tutorial introduces a website offering free templates for these assessments. Finally, it discusses assigning risk ratings and continuously monitoring high-risk vendors.

What is the first step in implementing Third Party Cyber Risk Management?

• Monitor risks continuously

• Evaluate the residual risk of vendors

• Identify all vendors and third parties

• Assign risk ratings to vendors

Why is inherent risk used for initial vendor classification?

• It focuses on compliance standards

• It requires less data from vendors

• It is faster and easier to classify vendors

• It is more detailed than residual risk

What tool can be used to assess residual risk?

• Security scorecard templates

• Compliance checklists

• Vendor risk management software

• Inherent risk analysis

What should be included in questionnaires to assess residual risk?

• Questions about vendor's financial stability

• Questions about vendor's customer service

• Questions about technical, process, and people controls

• Questions about vendor's market reputation

What is a key consideration when creating questionnaires for residual risk?

• Focusing only on financial risks

• Ensuring they are short and concise

• Including questions about compliance requirements

• Avoiding technical questions

How should high-risk vendors be managed?

• Ignore them until they become a problem

• Only monitor them without taking action

• Mitigate them based on importance and priority

• Treat them the same as low-risk vendors

What is the purpose of continuous monitoring in TPCRM?

• To update vendor contracts regularly

• To ensure vendors are paid on time

• To keep track of vendor performance

• To assess ongoing risks associated with third parties