Back in January I wrote a post entitled “TPRM,” and I want to expand upon that post.
But first I want to talk about [REDACTED].
Because people who have been around for a while have heard the phrase that if you’ve ever had [REDACTED] with someone, you’ve had [REDACTED] with everyone they’ve ever had [REDACTED] with. At least in terms of [REDACTED] transmitted diseases. Lloyds Pharmacy Online even developed a “[REDACTED] degrees of separation” calculator to quantify that exposure.
Beyond third-party risk
But enough about [REDACTED]. Your company’s data and information are subject to similar threats.
I mean, it’s all well and great for you to adopt a third-party risk management system to make sure that your vendors and suppliers aren’t letting bad things happen to your data and information.
But guess what? All those third parties have third parties of their own.
Risk and Compliance Magazine explains:
A fourth party is an independent entity that provides services to you on behalf of your third-party service provider – also known as your third party’s third party. A fourth party is also known as a subcontractor or sub-outsourcer. Fourth parties have not signed an agreement with your organisation, so they do not have a legally binding obligation to your business. Your third party itself may subcontract all or some obligations of their agreement to you to another service provider.
An example
Let me delve into an example that I touched upon in my January post.
- Let’s say that you did business with Bank of America.
- You checked out Bank of America’s systems as part of your due diligence.
- Perhaps you determined that everything was right and fine with the bank.
- But it was NOT right and fine with one of Bank of America’s software providers, which is a FOURTH party to you.
- So there’s this other system that you never contracted with.
- But perhaps you’re one of the unlucky 414-plus Bank of America customers whose data was exposed because of this fourth party.
And the fourth parties have fifth parties, the fifth parties have sixth parties, and so fourth. I mean forth.
Making an impact
Luckily there are companies that provide aids not only to address third-party risk, but also nth-party risk when data is transmitted all over the place.
Hence my acronym NPRM, Nth-party risk management.
Which really stands for “notice of proposed rulemaking,” but what the hey.
Anyway, these companies and many other technology companies are making an impact.
But does anyone know what these companies are doing?
Perhaps Bredemarket can help your company make an impact with my content, proposal, and analysis services. If so, let me know.
(The image was created by Imagen 3.)
Bredemarket 