TPA Banner

Third Party Risk Assessment
partnerships offer numerous benefits

In today's interconnected world, businesses rely heavily on third-party vendors for various services and goods. While these partnerships offer numerous benefits, they also introduce potential security risks, it is very important to implement a robust Third-party Risk Management program within our business. The Third-Party Assessment process will play a crucial in fortifying Disney Star's Cybersecurity program by identifying, assessing, and mitigating risks associated with third-party vendors.

content-secuirty

Mitigates various Risks

Businesses depend on third-party services, but these partnerships come with risks like cybersecurity threats, operational disruptions, compliance issues, and financial risks.

Third-Party Risk Management (TPRM) identifies and addresses these risks, protecting businesses from unforeseen consequences.

Regulatory compliance

Many industries have regulations requiring organizations to manage third-party risks.

TPMR helps ensure compliance with these regulations and avoid potential legal and financial penalties.

content-secuirty
content-secuirty

Ensures business continuity

By identifying potential disruptions from third-party issues, you can develop contingency plans and mitigate their impact on your operations.

This ensures smoother business continuity and minimizes potential downtime.

Improves reputation and brand trust

If a third party experiences a security breach or ethical violation, it can damage your reputation by association.

Proactive TPRM demonstrates your commitment to responsible business practices and builds trust with customers and stakeholders.

content-secuirty
content-secuirty

Enhances security and data protection

By understanding your third parties' security practices and data handling procedures, you can ensure they meet your standards and protect sensitive information.

This helps prevent data breaches and other security incidents.

content-secuirty

Data Security

This focuses on assessing a third party's ability to safeguard sensitive data they access or process on your behalf. This includes evaluating their:

  • Data encryption practices
  • Access controls and permissions
  • Incident response plans
  • Data breach history

Reference: NIST-Cryptography, ISO 27001 Annex A.10, Annex A.9, Annex A.16

Network Security

This evaluates the security posture of the third party's systems and networks to ensure they are not vulnerable to unauthorized access or attacks. This involves assessing:

  • Firewalls and intrusion detection systems
  • Vulnerability management practices
  • Patching and update protocols
  • Network segmentation and access control

Reference: NIST-Firewall, ISO 27001 Annex A.5, Annex A.9, Annex A.6, Annex A.13

content-secuirty
content-secuirty

Identity and Access Management (IAM)

This domain focuses on ensuring the third party has proper controls in place to manage user identities and access privileges to systems and data. This involves assessing:

  • Multi-factor authentication (MFA) implementation
  • Least privilege access principles
  • User provisioning and deprovisioning processes
  • Regular user access reviews

Reference: NIST-Identity and access management

Application Security

This domain assesses the security of any applications or software used by the third party that interact with your systems or data. This involves:

  • Code reviews and penetration testing
  • Vulnerability management for applications
  • Secure coding practices and standards

Reference: NIST-Secure system and application, ISO 27001 Annex A.12

content-secuirty
content-secuirty

Physical Security

This evaluates the physical security measures in place at the third party's facilities to protect sensitive information and resources. This involves:

  • Access control for physical locations
  • Security cameras and monitoring systems
  • Data storage security protocols
  • Environmental controls (e.g., temperature, humidity)

Reference: NIST-Physical security, ISO 27001 Annex A.11

Supply Chain Security

Evaluate the security posture of the third party's suppliers and vendors, considering potential vulnerabilities that could impact the organization. This involves:

  • Assessing supplier security practices
  • Obtaining information on supplier risk assessments
  • Insisting on strong supplier security standards

Reference: NIST-Supply chain risk management, ISO 27001 Annex A.15

content-secuirty
content-secuirty

Third-Party Cloud Security

Assess the security controls of any cloud services used by the third party that store or process your data. This involves:

  • Understanding the cloud service provider (CSP)
  • Evaluating the third party's cloud security practices
  • Contractual agreements

Reference: NIST-Cloud security

Insider Threat Management

Consider the risk of malicious activity by authorized users within the third-party organization. This includes:

  • Evaluating the third party's insider threat program
  • Assessing background checks
  • Considering access controls
  • Security awareness training

Reference: NIST-Insider threat

content-secuirty