Reporting & Analytics: Contract Language and Risk Acceptance

Question 1

Contract Language

Answer 1

-Variances
-Enforceability: very important
-Incident Notification

Question 2

Contract Language:
Incident Notification

Answer 2

-Make sure this language is in the contract and you clearly articulate how to report on this.

-Needs to be clearly mapped out.

-You have a delineation that are higher risk to your organization that you have a team that gets together should legal, compliance, regulatory.

-Don’t treat all events or all incidents the same.

Question 3

Risk Acceptance Overview

Answer 3

-If risk remediation cannot be performed, the next step is to escalate the risk and continue through an acceptance process.

-Your TPRM program should be prescriptive in the risk escalation and acceptance process.

-It should also be widely recognized and supported by your leadership.

-Furthermore, certain levels of leadership should be responsible for accepting specific levels of risk.

-Low
-Medium
-High
-Critical Controls

Question 4

Processing Risk Acceptance 1.

Answer 4

-Process for how risk acceptances are done and this is a risk based approach based on the risk to your organization.

-You don’t want all risks to be approached by the same individual.

-Need to have escalating risks approached by other’s where it makes sense.

-If you work for a decent sized organization and it’s finance and there’s commercial, retail, personal banking, inclurance, the commercial leding piece gets a risk acceptance and it’s a low or medium, when and if the vendor is breached no one will make a difference between the department that accepted the risk the name will say the whole organization made the mistake.

Question 5

Processing Risk Acceptance 2.

Answer 5

-The risk didn’t just go away, you just accept it for a period of time. This need to be accepted on an annual basis as potential threats and vulnerabilities are tracked and reported on as they add to the risk of the overall vendors.

-Risk acceptance done by contract limits, if your department cannot sign based on monetary amount then the risk can be accepted based on who can accept what contract.
-E.g. low and medium = business level, high and critical = executive level