Network and Information Security Directive 2 (NIS2) Third-Party Risk Management Compliance

Mitratech TPRM experts collaborate with your team to define and implement TPRM frameworks, strategies, processes and solutions in the context of your overall risk management approach; selecting risk assessment questionnaires and frameworks; and optimizing your program to address the entire third-party risk lifecycle – from sourcing and due diligence to termination and offboarding.

As part of this process, the Mitratech team will help you define:

• Clear roles and responsibilities (e.g., RACI).
• Third-party inventories.
• Risk scoring and thresholds based on your organization’s risk tolerance.
• Assessment and monitoring methodologies based on third-party criticality.
• Fourth-party mapping to understand risk in your extended vendor ecosystem.
• Sources of continuous monitoring data (cyber, business, reputational, financial).
• Key performance indicators (KPIs) and key risk indicators (KRIs).
• Governing policies, standards, systems and processes to protect data.
• Compliance and contractual reporting requirements against service levels.
• Incident response requirements.
• Risk and internal stakeholder reporting.
• Risk mitigation and remediation strategies.

The Prevalent solution helps to quantify inherent risks to effectively tier and categorize suppliers based on criticality, set appropriate levels of further diligence, and determine the scope of ongoing assessments.

Criteria used to calculate inherent risk for supplier tiering can include:

• Criticality to business performance and operations.
• Location(s) and related legal or regulatory considerations.
• Interaction with protected data, customer data or customer-facing systems.

Once tiering and categorization are complete, the Prevalent solution enables you to leverage a standardized NIS2 risk assessment, or any other of our more than 800 assessment templates to determine adherence to key third-party risk management principles. With the Prevalent solution, you can incorporate the due diligence assessment results into our central third-party risk management platform, and use workflow automations, task management, and automated evidence review capabilities to evaluate risk scores.

As part of your broader incident management strategy Prevalent ensures that your third-party incident response program enables your team to rapidly identify, respond to, report on, and mitigate the impact of third-party vendor security incidents.

Key capabilities include:

• Continuously updated and customizable event and incident management questionnaires.
• Real-time questionnaire completion progress tracking.
• Defined risk owners with automated chasing reminders to keep surveys on schedule.
• Proactive vendor reporting.
• Consolidated views of risk ratings, counts, scores and flagged responses for each vendor.
• Workflow rules to trigger automated playbooks to act on risks according to their potential impact on the business.
• Built-in reporting templates for internal and external stakeholders.
• Guidance from built-in remediation recommendations to reduce risk.
• Data and relationship mapping to identify relationships between your organization and third, fourth or Nth parties to visualize information paths and reveal at-risk data.

The Prevalent solution also includes databases that contain several years of data breach history for thousands of companies around the world – including types and quantities of stolen data; compliance and regulatory issues; and real-time vendor data breach notifications.
Armed with these insights, your team can better understand the scope and impact of the incident; what data was involved; whether the third party’s operations were impacted; and when remediations have been completed – all by leveraging experts.

Continuously track and analyze external threats to third parties with the Prevalent TPRM solution. With Prevalent, you can monitor the Internet and dark web for cyber threats and vulnerabilities, as well as public and private sources of reputational, sanctions and financial information.

Monitoring sources include:

• Criminal forums; onion pages; dark web special access forums; threat feeds; and paste sites for leaked credentials — as well as several security communities, code repositories, and vulnerability databases.
• Databases containing several years of data breach history for thousands of companies around the world.

All monitoring data is correlated with assessment results and centralized in a unified risk register for each vendor, streamlining risk review, reporting, remediation and response initiatives.

Once all assessment and monitoring data is correlated into the central risk register, apply risk scoring and prioritization according to a likelihood and impact model. This model frames risks into a matrix, so you can easily see the highest impact risks and can prioritize remediation efforts on those. Then, assign owners and track risks and remediations to a level acceptable to the business.

The Prevalent solution enables organizations to centralize the distribution, discussion, retention and review of vendor contracts to automate the contract lifecycle and ensure key clauses are enforced.

Key capabilities include:

• Centralized tracking of all contracts and contract attributes such as type, key dates, value, reminders and status – with customized, role-based views.
• Workflow capabilities (based on user or contract type) to automate the contract management lifecycle.
• Automated reminders and overdue notices to streamline contract reviews.
• Centralized contract discussion and comment tracking.
• Contract and document storage with role-based permissions and audit trails of all access.
• Version control tracking that supports offline contract and document edits.
• Role-based permissions that enable allocation of duties, access to contracts, and read/write/modify access.

Continually evaluate the effectiveness of your TPRM program according to changing business needs and priorities, measuring third-party vendor key performance indicators (KPIs) and key risk indicators (KRIs) through the relationship lifecycle.

With this capability, you can ensure that clear responsibilities and right-to-audit clauses are articulated in the vendor contract, and SLAs tracked and managed accordingly.