Risk Management for Cyber Security Managers - Steps to Implement TPCRM

The video tutorial outlines the steps for implementing Third Party Cyber Risk Management (TPCRM). It begins with identifying all vendors, focusing on those with access to important data. The next step involves evaluating inherent risk, which is faster than assessing residual risk. Once vendors are classified by inherent risk, residual risk is assessed using questionnaires, considering compliance standards. The tutorial introduces a website offering free templates for these assessments. Finally, it discusses assigning risk ratings and continuously monitoring high-risk vendors.

What is the first step in implementing your Third Party Cyber Risk Management (TPCRM)?

How should you evaluate the risk associated with vendors?

What is the difference between inherent risk and residual risk in vendor classification?

What types of questions should be included in the questionnaires for assessing vendors?

What are the three categories of risk ratings that can be assigned to vendors?

What steps should be taken for vendors classified with high risk?

Why is it important to continuously monitor risks associated with third-party vendors?