Third-party Risk Management: SOC 2s, Security Questionnaires...
summary
Condemns checkbox vendor risk processes and argues TPRM must produce concrete outcomes: track vendor response time (commonly six weeks), treat SOC 2 reports skeptically (qualified reports hide incidents), and stop sending needless questionnaires. Recommends embedding assessments into procurement and design reviews, use AI for initial document review with human oversight, define and enforce a company-specific risk tolerance, and adopt security addendum (MVSP or situation‑specific) and contract-based risk transfers so contractual commitments replace fruitless evidence-chasing.
AI-written summary · about
chapters (16)
- 0:00Introduction and speaker intro
- 1:04What is third-party risk management
- 3:54Benefits of TPRM programs
- 4:58Industry drivers for TPRM
- 6:02Problems in TPRM today
- 8:26Security questionnaires issues
- 9:07Unreliable audit reports
- 10:12Misleading trust demonstrations
- 11:57Dirty contracting tactics
- 13:43Embedding TPRM in processes
- 14:27Tracking metrics for improvement
- 15:30Defining risk tolerance
- 16:33Discerning vendor information
- 16:54Creative contracting approaches
- 18:57Conclusion and takeaways
- 19:41Q&A session
related talks
51mYour Third-Party Risk Management Program Is Bad and You Should Feel Bad
51mThe Overlooked Security Risk: 3rd Party Risk Management
29mVendor Security: Where Our Data Goes We Follow
36mSupplier Risk Where OSS Collides With Vendor Management
29m3rd-Party Cyber-Risk Mitigation by Using ISO Standards
31mThird-Party Risk Management: Preventing the Next Stuxnet
23mAdventures in Vendor Security and Continuous Review
08mMaximizing Security and Compliance through Digital Third Party Risk Management