NBA Third-Party Data Breach: 7 Plays to Avoid Shooting Air Balls

#4. Diagram Effective Plays and Respond Aggressively

Successful basketball teams play their game but constantly adjust their approach to improve their chances of winning. Agility is key here, and in third-party risk management that means continually assessing risks and responding to third-party vendor incidents accordingly.

Key components of an effective third-party incident response program include:

• Automated event and incident management questionnaires to determine risk exposure
• Defined risk owners with automated chasing reminders to keep surveys on schedule
• Proactive vendor reporting to accelerate risk response
• Workflow rules to trigger actions on risks according to their potential impact to the business
• Guidance from built-in remediation recommendations to reduce risk
• Built-in report templates
• Data and relationship mapping to identify relationships between your organization and third parties to visualize information paths and determine at-risk data

Standardizing on a risk response framework will improve team performance by aligning around a singe set of expectations.

#5. Maintain Possession

In college basketball, the possession arrow is used to determine which team will gain possession in situations where definitive control of the ball is not clear. For third-party risk management teams, we extend that definition to include the possession of data – sometimes you have it, and sometimes a third, fourth or Nth party has it.

To limit your risk exposure to data security incidents in your extended vendor ecosystem, identify fourth-party and Nth-party subcontracting relationships by conducting a questionnaire-based assessment or by passively scanning the third party’s public-facing infrastructure. The resulting relationship map will depict information paths and dependencies that could expose your environment to risk.

Once this is determined, conduct data security and privacy assessment. Key considerations should include:

• Privacy Impact Assessments to uncover at-risk business data and where personally identifiable information (PII) exists, where it is shared, and who has access
• Control mapping and reporting against privacy regulations
• Continuous vendor data breach monitoring – including types and quantities of stolen data; compliance and regulatory issues; and real-time vendor data breach notifications
• Enforcing contractual data protection provisions from the beginning of the relationship

Knowing who has the ball (or in this case the data) is the first step to improving third-party incident response.

#6. Avoid Fouls

Nothing can alter a basketball team’s momentum more than a mis-timed foul. For third-party risk management teams, fouls can mean a damaging compliance violation. To efficiently demonstrate compliance and avoid fines, automate the collection of vendor risk information; quantify risks; offer remediations to vendors (or require compensating controls); and map results to established IT security controls frameworks such as ISO 27001, NIST, and others. A proactive view into vendor security practices can help your team get ahead of potential compliance fouls and speed reporting during audits.

#7. Know When to Trade Up

When the losses pile up or when team chemistry is suffering it may be time to change the lineup, and that could mean a trade. For third-party risk management teams, this means constantly monitoring contractual performance and offboarding vendors when KPIs, KRIs or SLAs are missed.

When a termination is required, leverage automation and workflows to:

• Perform a final review of the contract
• Settle any outstanding invoices
• Revoke access to IT infrastructure, data and physical buildings
• Review data privacy and information security compliance
• Update your vendor management database
• Continuously monitoring vendors for potential future risks

Performing these tasks will reduce your organization’s post-contract risk exposure.

Next Steps to Mitigate Third-Party Data Breach Risks

If a cybersecurity incident such as the NBA data breach occurred in your vendor ecosystem, would your organization be able to quickly understand its implications to your business and activate its own incident response plan? Consider running these seven plays to improve your team’s performance, download the third-party incident response checklist, or contact us to schedule a personalized demonstration today.