Pre-Contract: 4th Party

Question 1

4th Party

Answer 1

-Risk-based approach for Nth party
-Treat as a Vulnerability Management program
-Leverage Cyber Continuous Monitoring and Cyber Threat intake process
-Focus on only material 4th parties, where data is at, and the relationship b/t 3rd and 4th party.

Question 2

4th Party Risk Based Approach

Answer 2

-Average is a dozen 4th party for each of your 3rd party
-Just starting out, start with critical vendor’s 4th parties
-In IRQ intake, ask about 4th parties
-Material could mean they have your data, they have contact with your customers, where is the data at in the relationship to the 3rd and 4th party
-Ask prior to contract
-Be focused on the intake process
-You wouldn’t necessarily be asking for this for your lower risk vendors
-Make sure you’re not taking in data you’re not going to do anything with

Question 3

3 Types of Material Vendors for the Information Received

Answer 3

1. If they will house/transfer data
2. If they are material to product services you are receiving
3. If they will have contact with your customers like a call center

Add in contract - they must notify if they ADD any new contractors or quit using contractors or if the contractors are bought