Third Party Risk Management (TPRM)
Community Posts
My agency is looking for a system and operations center to prevent exfiltration of data. We have looked at Varonis and Blackfog. Any thoughts on these products or are there any suggestions of other products?
A common challenge in our risk-tiering framework for suppliers is that even the lowest risk tier still requires processing.
Has anyone implemented a "not relevant" risk tier in their model?
This tier would apply to vendors posing genuinely negligible security risk.
If your org uses third-party IoT solutions, what criteria do you use to assess those vendors' security practices?
Does your security awareness training address files shared over communications platforms like Microsoft Teams?
Yes80%
No18%
Other (comment below)1%
“Risk needs to be quantified in monetary value.”
Strongly agree15%
Agree63%
Neutral17%
Disagree3%
Strongly disagree
Other (explain in the comments)
How are you thinking about vendor risk management when it comes to vendors leveraging generative AI? Do they require a different approach, or is your current vendor risk strategy adequate in these cases?
We have recently updated our strategy.21%
Yes48%
No, but I expect we will reevaluate our strategy.20%
No9%
Other (please share in the comments)