Third-Party and Supply Chain Risk

Third-Party and Supply Chain Risk (CGEIT – Risk Optimization)

Introduction
Third-party and supply chain risk is a core topic in the CGEIT Risk Optimization domain. Modern enterprises rely heavily on external parties: cloud service providers, outsourcers, software vendors, managed security providers, contractors, and their own subcontractors (fourth parties). Each relationship extends the enterprise's attack surface and operational dependency. Governance is accountable for these risks even when the activity is performed by someone else. In CGEIT terms, you can outsource a service, but you cannot outsource accountability.

Why It Is Important
1. Accountability stays with the enterprise. The board and executive management remain accountable for outcomes, regulatory compliance, and stakeholder value, regardless of who delivers the service.
2. The attack surface keeps growing. Major breaches have come through vendors. Examples include the SolarWinds software supply chain compromise, the Target breach through an HVAC contractor, and the MOVEit file-transfer exploitation. One weak supplier can compromise many customers at once.
3. Concentration and continuity risk. Heavy dependency on a single cloud provider or a critical component supplier creates single points of failure that affect business continuity and resilience.
4. Regulatory pressure. Many laws and rules explicitly require oversight of third parties. Examples include GDPR (processor obligations), DORA in the EU financial sector, SOX, HIPAA business associates, and PCI DSS service providers.
5. Value delivery. Poorly governed vendors lead to cost overruns, missed service levels, lock-in, and failure to realize benefits. Risk optimization means balancing these risks against the value that sourcing brings.
6. Reputation. Customers blame the brand they deal with, not the hidden subcontractor.

What It Is
Third-party risk is the potential for loss or harm arising from any external entity that provides products, services, or access to the enterprise. The main risk types are:
- Information security and privacy: data breaches and unauthorized access.
- Operational and availability: outages and SLA failures.
- Compliance and legal: regulatory breaches and contractual non-compliance.
- Financial: vendor insolvency.
- Strategic: lock-in and misalignment with enterprise direction.
- Reputational: brand damage from a vendor's conduct.
- Geopolitical and concentration: location-based exposure and over-reliance on one provider.

Supply chain risk is broader. It covers the whole chain of suppliers and their suppliers (nth parties) that contribute to products and services. It includes hardware and software integrity, counterfeit components, compromised updates, and open-source dependencies. A software bill of materials (SBOM) helps make these dependencies visible.

Key Concepts
- Fourth-party / nth-party risk: the risk from your vendor's vendors.
- Inherent vs. residual risk: inherent risk is the risk before controls are applied; residual risk is what remains after vendor and enterprise controls.
- Shared responsibility model: in cloud services, the provider and the customer each own specific controls.
- Right to audit: a contractual clause that lets the enterprise or its delegate assess the vendor.
- Independent assurance: reports such as SOC 1 and SOC 2 Type II, ISO 27001 certification, and CSA STAR.
- Exit strategy: a planned and tested way to move away from a vendor.

How It Works: The Third-Party Risk Management (TPRM) Lifecycle
1. Governance and strategy
- The board approves a sourcing strategy and sets risk appetite for third-party reliance.
- A TPRM policy defines roles: business owner, procurement, legal, risk, security, and internal audit.
- These activities align with COBIT 2019 objectives such as APO10 (Managed Vendors), APO12 (Managed Risk), EDM03 (Ensured Risk Optimization), and APO09 (Managed Service Agreements).

2. Planning and business case
- Define requirements and decide whether to outsource at all, based on the value and risk trade-off.

3. Inventory and classification (tiering)
- Maintain a complete register of third parties.
- Classify each by criticality and inherent risk, considering data sensitivity, business impact, and regulatory relevance.
- The tier drives how much due diligence and monitoring the vendor receives.

4. Due diligence and selection
- Use security questionnaires, financial stability checks, and reviews of certifications and SOC reports.
- Consider references, site visits, and business continuity capability.

5. Contracting
- Include SLAs and KPIs, security and privacy requirements, and the right to audit.
- Add breach notification timelines, subcontracting restrictions, and data ownership and return terms.
- Cover liability and indemnity, termination and exit clauses, and escrow where relevant.

6. Onboarding
- Provision access on a least-privilege basis.
- Integrate the vendor into incident response and change management.

7. Ongoing monitoring
- Hold regular performance reviews and track SLA and KRI results.
- Reassess vendors periodically according to their tier.
- Use continuous security ratings, review updated SOC reports, and watch for adverse news and financial changes.

8. Issue management
- Track remediation plans and escalate breaches of risk appetite to the appropriate level.

9. Offboarding and exit
- Revoke access and return or destroy data, with certification.
- Transition knowledge and execute the tested exit plan.

Risk Responses Applied to Third Parties
- Mitigate: contractual controls, monitoring, and technical safeguards such as encryption with customer-held keys.
- Transfer: cyber insurance and indemnity clauses. Note that transfer moves the financial impact, not the accountability.
- Avoid: do not outsource a critical function, or exit a high-risk vendor.
- Accept: formally accept residual risk within appetite, with sign-off by the risk owner.

Metrics and Reporting
Report the following to senior management and the board in business terms:
- Percentage of critical vendors assessed on schedule.
- Number of open high-risk findings.
- Vendor-caused incidents.
- SLA attainment.
- Concentration exposure.

Exam Tips: Answering Questions on Third-Party and Supply Chain Risk
1. Think like a governance executive, not a technician. CGEIT rewards answers about direction, accountability, policy, alignment, and oversight. Prefer answers such as establishing a framework, defining policy, assigning ownership, or aligning with risk appetite over hands-on technical fixes.

2. Accountability cannot be outsourced. If an option implies the vendor is now accountable for the enterprise's compliance or risk, it is almost always wrong. The enterprise (ultimately the board) remains accountable.

3. Contract first. For questions about what is MOST important before signing, or how to ensure the enterprise can assess a vendor, look for the right-to-audit clause, defined security requirements, SLAs, and breach notification terms. Controls not written into the contract are hard to enforce later.

4. Due diligence before selection; monitoring after. Watch the lifecycle stage in the question:
- Before engagement, the answer is risk assessment and due diligence.
- After engagement, the answer is monitoring performance against SLAs and reviewing assurance reports.
- At termination, the answer is exit planning and data return or destruction.

5. Risk-based tiering. When asked how to manage many vendors efficiently, choose classification by criticality and risk, then apply proportionate oversight. Assessing every vendor equally is rarely the best answer.

6. Independent assurance. If the right to audit is impractical, for example with hyperscale cloud providers, the best answer is usually to rely on independent third-party assurance such as SOC 2 Type II or ISO 27001. Type II is better than Type I because it tests operating effectiveness over a period of time.

7. Business case and value. When the question asks the PRIMARY reason or FIRST step in an outsourcing decision, link it to enterprise strategy and the business case. Sourcing must support business objectives within risk appetite.

8. Fourth parties. Look for answers requiring vendors to disclose subcontractors, flow down equivalent security requirements, and obtain approval before subcontracting critical services.

9. Concentration and exit. For resilience questions about a single critical provider, think of exit strategies, multi-sourcing, portability, and business continuity plans that include vendor failure scenarios.

10. Insurance is not a complete answer. Transfer reduces financial impact but does not address reputational, regulatory, or operational impact, and it does not transfer accountability.

11. Keywords to watch:
- FIRST usually means assess, understand, or identify.
- BEST usually means the most comprehensive, governance-level option.
- MOST important usually means alignment with objectives or a contractual safeguard.
- PRIMARY responsibility usually points to the business owner or the board.

12. Reporting. The best way to inform the board is aggregated, risk-based reporting tied to appetite and business impact. Raw technical findings are not the right answer.

13. Elimination strategy. Discard options that:
- are purely operational when a governance option exists;
- shift accountability to the vendor;
- happen too late in the lifecycle;
- ignore the enterprise risk appetite.

Sample Question
An enterprise plans to move customer data to a SaaS provider. Which of the following should the IT steering committee ensure FIRST?
A) Encryption is configured.
B) A risk assessment aligned with enterprise risk appetite and the business case is performed.
C) Cyber insurance is purchased.
D) The SLA includes 99.9% uptime.

Answer: B. It is the governance-level first step. A, C, and D are later or partial measures.

Summary
Third-party and supply chain risk management ensures the enterprise gains value from external parties while keeping risk within appetite. It works across the full lifecycle: strategy, tiering, due diligence, contracting, monitoring, and exit. It is supported by clear accountability, contractual protection, independent assurance, and board-level reporting. In the exam, choose answers that keep accountability with the enterprise, act early in the lifecycle, are risk-based, and are anchored in governance and business objectives.