How to Select the Right Third-Party Risk Metrics to Report to the Board

Having been a CISO for large multi-national corporations for over 20 years, I have created, run and evolved third-party risk management programs for some very complex organizations. That experience taught me a lot, including what worked and what did not. Now, as CEO of Cambridge Cyber Advisers, I sit on the other side of the board table working alongside the Board Chair to support the CISO in achieving the maximum possible risk reduction across the full security spectrum.

In my role as a board advisor, I often observe complex metrics and data being reported up to management from the security team. All too often, much of the intended message and desired outcomes are lost in translation as the security team has to massage the data for non-security audiences. To accomplish this, the security team creates their own set of meaningful metrics.

In this post I will define meaningful metrics, discuss the challenges I see with determining the right metrics to report to the board, and describe a mature approach to third-party risk metric reporting.

What Are Meaningful Metrics and How Do They Apply to Third-Party Risk Management?

Security reporting should be clear and concise, and in no other area is this more critical than in third-party assurance. Third-party assurance is one of the most challenging risk areas to quantify and manage from a CISO’s perspective due to three factors:

1. the large size of third-party ecosystems
2. the constant level of change among suppliers
3. the resourcing challenges that come with simultaneously managing thousands of vendors

Meaningful metrics, therefore, are needed to clearly articulate a consolidated set of key performance indicators (KPIs) and key risk indicators (KRIs) to executives or board members. These metrics reduce the need to analyze large, complex security dashboards by distilling the real security implications behind the numbers.

An example of a meaningful metric is Mean Time to Detect (MTTD). This metric shows the board how effective you are in detecting issues within the supply chain; how leading and lagging KPIs/KRIs are performing; and includes information from technical, process and cultural aspects. The extra details are always available if required, but it is important to present a consolidated and meaningful metric in the first place.