The headlines are constantly full of data breaches. Every week we see more and more cases of data being compromised and increasingly, we are hearing about a company’s data being compromised due to hackers gaining access to it through a third party vendor.

The cyber risk profile of third party suppliers or providers is an integral part of your own cyber risk management procedures.

When a third party has access to an organisation’s systems and data, this inherently compromises those network systems, and exposes the data to the security vulnerabilities of the third party’s own systems and processes.

Expanding a business through integrated networks, partnerships and third party service providers is integral but the risks associated with third party cyber attacks have never been more significant.

So what steps can be taken to minimise the risk of your third party provider exposing you to cyber threat and breaches of your cyber security.

1. Include third party providers in your company’s risk assessments: managing third party relationships is a critical part of any risk mitigation strategy
2. Identify all vendors that have access to sensitive data, confidential information or a network and rank them according to the level or severity of risk associated with that relationship.
3. Track your data flow: Make your data a priority and have in place mechanisms to track the flow of data easily.
4. Assess how you third party suppliers safeguard their data and compare it to your standard. If it falls short, insist they implement controls to safeguard data and to reach the same level of cyber security as your own organisation.
5. Formalise third party management by entering into an agreement with third party vendors outlining how cyber risk management will be undertaken.
6. If you have a number of third party vendors, establish a third party management committee. This Committee will be an administrative team that oversees third party risks in general.
7. Manage risk across the entire lifecycle of the relationship: this involves due diligence before entering into a third party relationship and also ongoing auditing and due diligence. It also includes thinking about how to manage any ongoing risks after the relationship is terminated.
8. Utilise industry standards and other leading practices to create risk profiles for third parties:
9. Create an incident response plan that includes planning and rehearsal for a third party-instigated cyber event.

10. Mitigate risk by taking out Cyber insurance and ensure the cyber policy includes coverage for losses to your business stemming from any third party suppliers.