Organizations increasingly depend on vast ecosystems of thirdparty vendors, expanding their operational capacity—but also their attack surface and risk exposure. This talk challenges trustby-default approaches to vendor relationships and makes the case for a modern, thirdparty risk management (TPRM) program. We begin by framing why vendor risk matters, examine realworld breach case studies to illustrate how upstream dependencies and fourthparty links can amplify impact. The session will highlight regulatory drivers—NIS2, DORA, and GDPR—and translates them into practical expectations for supplychain security, continuous oversight, and incident reporting. We analyze limitations of traditional questionnaires (SIG/CAIQ), which are static, selfreported, and often out of date, and propose a continuous TPRM lifecycle: riskbased vendor tiering, due diligence proportional to criticality, automated external posture monitoring, corrective action tracking, and secure offboarding.
Participants will leave with actionable items to embed TPRM into procurement, legal, and IT workflows; strategies to require flowdown security in subcontractor chains; and pragmatic steps to start small, demonstrate value, and scale. Resulting in a repeatable approach that strengthens resilience, improves compliance, and replaces blind trust with verifiable assurance.
This Training is Recommended for a Diverse Range of Individuals, Including:
- Security Managers
- Security Leaders
- Third Party Security Responsibles
- CISOs
And more…
Learning Objectives
- Understand and prioritize risk: Explain how third and fourthparty ecosystems expand the attack surface and regulatory exposure (NIS2, DORA, GDPR), and map key dependencies to prioritize vendor risks.
- Implement a continuous TPRM lifecycle: Apply riskbased tiering, evidencebased due diligence, automated monitoring, correctiveaction tracking, and secure offboarding—embedded in procurement and legal workflows.
This webcast supports content and knowledge from LDR512: Security Leadership Essentials for Managers. To learn more about this course and explore upcoming sessions, Click Here.
