Financial sector concerned about third-party cyber risk
Many organizations work with hundreds of third parties, creating new risks that must be actively managed. The financial industry, in particular, has a massive business ecosystem made up of legal organizations, accounting and human resources firms, management consulting and outsourcing firms, and information technology and software providers.
A new study into the financial services sector from security ratings company BitSight finds that 97 percent of respondents say cyber risk affecting third parties is a major issue.
In addition, nearly 80 percent of respondents say they have terminated or would decline a business relationship due to a vendor's cybersecurity performance. One in 10 organizations has created a job role specifically dedicated to vendor, third-party or supplier risk.
"Managing third-party cyber risk has rapidly become the number one concern for businesses," says Jake Olcott, vice president of communications and government affairs at BitSight. "Many in the financial sector are taking action to manage that risk, but as our survey shows, there is vast room for improvement in key areas like continuous monitoring and effective board reporting."
Among other findings are that only 44 percent of respondents are reporting on this risk to their executives and boards on a regular basis. This lack of regular reporting could be the reason why nearly one in five respondents think boards and executives are not confident or do not understand their approaches to third-party risk management (TPRM).
Respondents report that they still rely on tools like annual on-site assessments, questionnaires and facility tours to assess third-party security posture, giving them limited visibility into their third-party cyber risk. Meanwhile, only 22 percent of organizations are currently using a security ratings service to continuously monitor the cybersecurity performance of third parties, though 30 percent say they are currently evaluating security ratings providers.
You can find out more in the full report, available from the BitSight website.
Photo Credit: Pixelbliss/Shutterstock