UpGuard：2023第三方风险管理全指南（中译版）（32页）.pdf

1、A Complete Guide toThird-Party Risk MiiTable of ContentsIntroduction iiiGetting Started With Third-Party Risk Management 1What is a Third-Party?2What is Third-Party Risk Management?3Third-Party Risk Management vs.Vendor Risk Management 5Do you Need a TPRM and a VRM Solution?6The Third-Party Risk Man

2、agement Lifecycle 7The Third-Party Risk Management Lifecycle 8Integrating a Feedback Loop 12How to Evaluate Third-Party Risks 15Common Challenges of Third-Party Risk Management 18Integrating a TPRM with Your Existing Framework 21 iiiIntroductionIf youre currently outsourcing to third-party entities,

3、youre increasing your risk exposure to a data breach.Each of your vendors has some level of access to your internal systems,so if one of them suffers a data breach,they could quickly turn from a trusted partner into a critical attack vector.According to the 2022 Cost of a Data Breach report by IBM a

4、nd the Ponemon Institute,vulnerabilities in third-party software(one of many third-party risk categories)were the third most expensive data breach attack vector in 2022,resulting in damages of up to USD 4.55 million(an increase of 13%compared to 2021).An effective Third-Party Risk Management Program

5、 reduces vendor security risks leading to data breaches,which also reduces the risk of costly damages associated with these events.https:/ Started with Third-Party Risk M2What is a Third-Party?A third party is any entity that your organization works with.This includes suppliers,manufacturers,service

6、 providers,business partners,affiliates,distributors,resellers,agents,and vendors.Because third-party relationships are vital to business operations,Third-Party Risk Management is an essential component of all Cybersecurity programs.Whats the Difference Between a Third-Party and a Fourth-Party?A thi