Service Description
Managing third-party risks is not only challenging but also time and resource consuming. It requires substantial investement of time to identify and mitigate third-party risks, most of which is spent on following-up with the third-parties.
With increasing trend of data breaches via third-parties, the criticality of managing third party risks has increased too and organizations are finding it challenging to scale their existing third-party program coverage due to -
- Limited resource availability
- Manual processes
- Limited budget
Shield Advantage
Our ‘Third-Party Risk Management’ as a Service is a unique managed service model that supports your growing third-party risk management needs. The model offers an opportunity to select from ala carte services required to meet the on demand, short-term, and long-term risk management requirements.
Our Services provides you with –
– A flexible engagement model which allows you to the flexiblity to pick the options that suits you best. You can choose on-demand, fixed quantity, staff augmentation or a service model that is delivered in an onsite, remote, near shore or off-shore format.
– Scalable Services where you can choose from services only or services & technology options to address your risk management needs across third-party lifecycle
– Plug ‘n Play Model provides you with a ready to use assessment framework with a question bank mapped to regulatory frameworks and integrated with external tools for continuous monitoring
Strategy
Our fit-for-purpose approach provides you with
- Enhanced risk coverage over the lifecycle of your third-parties
- Near real-time risk monitoring of business critical third-parties
- Tools to identify and prioritize of your critical vendors
- Efficient resource allocation
- On-going monitoring and remediation based on risk prioritization
We provide tiered services to meet your individual needs that cover one or more of the following phases in a standard third-party assessment lifecycle
- Third-Party Prioritization
- Pre-Assesssment Support
- Assessment Reviews
- Findings & Recommendations
- Remediation Follow-up
- Continuous Monitoring
Consulting
Our flexible TPRM framework where you own the data is bolted on your existing program and GRC/TPRM tools implemented (such as RSA Archer, IBM Open Pages, Servicenow etc.) to manage third-party risks.
The following activities are performed as part of each phase of the third-party lifecycle:
Third-Party Prioritization
We augment your existing risk-based approach blended with third-party risk intel gathered from external sources to classify, prioritize and assess the most critical third-parties first.
Pre-Assesssment Support
We provide tailored assessments, liaison on your behalf with the third-party contact, our relationship manager responds to assessment and post assessment follow-up.
Assessment Reviews
We review completed assessments along with supporting documents (SOC 1&2 reports, policies etc.), and map against control framework/regulatory requirements for third-parties, 4th parties and Nth parties.
Findings & Recommendations
We document findings and recommend actions to remediate identified gaps, and create assessment review report.
Remediation Follow-up
We liaison with third-party contacts, our relationship manager works with you on recommendations and post-remediation review.
Continuous Monitoring
We empower you to proactively monitor third-parties via integrated external feeds to enable continuous monitoring of financial health, security and privacy events and trigger ad hoc assessments to timely identify and mitigate risks.
We also work with you to implement a Third-party program on various GRC/TPRM tools available in the market today to help you automate your processes if needed.
Technology Enablement
To provide you with the best service experience, we have partnered with the industry leading third-party data providers like RiskRecon, RapidRatings, CyberGRX, BlackKite.
With our tool agnostic approach we enable you to get up and running with your TPRM program no matter if you are just starting out or have mature TPRM processes established.
We provide pre-built plug ‘n play TPRM solutions that you can leverage as is or as the first building block for automating your TPRM program lifecycle.Our Partners
Together with leading technology and service providers, we are committed to curating and bringing the latest in innovation and capability
to enable you to transform your third-party risk management program.
