{"id":4133,"date":"2019-01-02T11:07:13","date_gmt":"2019-01-02T15:07:13","guid":{"rendered":"https:\/\/solutionsreview.com\/identity-management\/?p=4133"},"modified":"2019-01-02T11:07:13","modified_gmt":"2019-01-02T15:07:13","slug":"enterprises-must-oversee-third-party-risk-and-data-management","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/identity-management\/enterprises-must-oversee-third-party-risk-and-data-management\/","title":{"rendered":"Enterprises Must Oversee Third-Party Risk and Data Management"},"content":{"rendered":"

\"Enterprises<\/p>\n

By Steve Richardson<\/b><\/p>\n

Vice President of Product Management,<\/b> Fusion Risk Management<\/b><\/a><\/span><\/p>\n

Every week it seems there is another article about a company suffering a data breach\u2014from Google<\/a> to Equifax<\/a>. As the world becomes more connected and businesses collect data at an increasingly rapid rate, hackers and cybercriminals are keeping pace with security protocols and consistently finding ways to get around them\u2014sometimes almost as soon as they are implemented.<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

Data now is currency\u2014in fact, many hackers would much rather steal consumer data than a finite sum of money. While organizations must be in control of their security and data protection obligations and practices, they must also be vigilant about how their third-party service providers approach these crucial components. The success of an organization depends on the security and resiliency of the third parties with which they partner and, often, share data. If companies do not thoroughly vet these providers, the consequences can be dire.<\/span><\/p>\n

Steve Richardson, Vice President of Product Management for<\/span> Fusion Risk Management<\/b><\/a><\/span>, <\/b>recently spoke with Solutions Review on the importance of third-party<\/a> risk management when creating their data security and risk management plans. Here\u2019s our conversation, edited slightly for readability: <\/span><\/p>\n

Solutions Review: What are the potential implications for organizations that don\u2019t address third-party risk sufficiently?<\/b><\/h4>\n

Steve Richardson: The implications can be severe. In 2018 alone, large-scale organizations have experienced breaches that affected not only their bottom lines but also their reputations. One incident involved Saks Fifth Avenue and Lord & Taylor, when cybercriminals tapped into an unsecured point of their sales system and stole more than 5 million customer credit card numbers.<\/span><\/p>\n

In another instance, a customer service vendor for Best Buy, Sears, Kmart, and Delta was hacked via malware and credit card information, addresses, and other personal data of hundreds of thousands of customers was compromised. These incidents, and others like them, have led to negative media attention and customer mistrust \u2013 two things any business must avoid at all costs.<\/span><\/p>\n

SR: Why do you think enterprises are struggling to protect themselves?<\/b><\/h4>\n

Steve Richardson: As organizations look for ways to solve the security problems inherent in many of their business partnerships, they require a system that is tailored to different user experiences and needs which remains accessible for all parties. Unfortunately, many companies aren\u2019t sure how exactly to approach this and end up relying on outdated methods such as spreadsheets and email to track and maintain their risk assessments and third-party relationships.<\/span><\/p>\n

SR: How can these methods impact enterprises moving forward?<\/b><\/h4>\n

Steve Richardson: Manual processes, spreadsheets, and email are not scalable or sustainable models for managing third-party risk for many reasons. Increased spending with third-parties, new and stricter privacy legislation, and increased media coverage of information security breaches increase the risk a business faces when entering third-party relationships as well as the risks resulting from inconsistent or error-prone assessment processes.<\/span><\/p>\n

Companies are spending more money\u2014and are relying more heavily\u2014on third parties to manage crucial areas of their business because it can reduce internal costs and cut down on internal hiring and training of full-time employees. While this option may be more convenient, companies must also pay attention to how third-parties protect and store sensitive data as well as address their own risk and compliance obligations.<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

SR: What else do businesses need to consider when building processes and storing information?<\/b><\/h4>\n

Steve Richardson: Companies must also consider the General Data Protection Regulation (GDPR), which took effect in the European Union (EU) on May 25 2018, and consolidated all privacy laws into one regulation. <\/span><\/p>\n

GDPR has expanded the privacy rights of individuals in every EU country and has put much stricter rules around how organizations handle the personal data of their customers and employees. GDPR enforcement doesn\u2019t just apply to countries in the EU \u2013 but to every company that does business there where European citizens\u2019 data is stored or processed. The broad nature of GDPR makes it even more evident just how much importance people around the globe place on their privacy. GDPR increases obligations for companies to ensure privacy for their employees and customers \u2013 which includes a thorough vetting of all third-party relationships.<\/span><\/p>\n

SR: What steps do you recommend organizations take to build an effective solution?<\/b><\/h4>\n

Steve Richardson:<\/span> They have to do away with legacy governance, risk management, and compliance (GRC) solutions in favor of an integrated solution that incorporates third-parties in broader risk management and resiliency strategies. The solution must provide third-parties with access to information, due dates, and standardized assessment work-streams through a secure portal designed with ease-of-use in mind. <\/span><\/p>\n

When an organization brings third-parties into the solution, with shared information and standardized processes, it accomplishes these four things:<\/span><\/p>\n