third party governance role:
. vendor risk identification and analysis:
• revise the vendor risk assessment playbook, process, and procedures to ensure they're up-to-date with industry practices.
• construct a risk assessment plan using a standardized approach to minimize the bank's exposure to third-party vendor risks.
b. third party cyber risk assessments:
• analyse third-party cyber risk assessment documents and procedures to ensure comprehensive risk management.
• continually monitor and adapt to new risks, ensuring that assessment strategies are proactive.
c. tools, measurement, and analysis:
• scrutinize and validate cyber tools and create test cases to assess the effectiveness of third-party cyber risk tools.
• optimize the use of jira for improved tracking and management of cyber assessments.
d. program governance – cyber pmo:
• establish a cyber program management office to oversee and align cyber risk projects with organizational goals.
• provide ongoing support for cyber risk initiatives and ensure effective communication among all stakeholders.
vendor risk assessment and mitigation
1. walkthroughs and understanding: conducting in-depth sessions with application owners to comprehend the application architecture, services provided, and it processes involved.
2. assessment scope and connectivity: defining the scope of the assessment and identifying how vendor services connect with the organization’s existing architecture.
3. questionnaire distribution and assistance: tailoring assessment questionnaires based on vendor service applicability and facilitating stakeholders in completing them.
4. evidence review and follow-ups: reviewing the evidence provided by stakeholders and conducting follow-up meetings for clarification and understanding of responses.
5. gap analysis and validation: analysing the questionnaires to identify gaps and conducting validation sessions with stakeholders on the findings.
6. risk assessment reporting: compiling