Third-Party Management

Strategic Third-Party Management: KPIs, KRIs, KCIs, and the Procurement Lifecycle

Third-Party Management is more than just contract administration; it is a strategic function that directly impacts IT efficiency and security. In this chapter of my portfolio I will highlight my experience in maximizing the value of third-party partnerships within Internal IT. Discover my analytical reports, performance metrics, risk mitigation plans, and insights into building strong, collaborative vendor relationships.

Effective third-party management is critical for minimizing risk and maximizing value. This section highlights my approach to monitoring and enhancing third-party relationships through strategic KPIs, Key Risk Indicators (KRIs), Key Control Indicators (KCIs), and a comprehensive understanding of the procurement lifecycle.

Key Areas of Focus:

Third-Party Risk Assessment:
- Evaluate the risk posture of the supply chain, ensuring balanced risk distribution across all tiers.
- Assess organizational awareness of third-party threats, tracking the percentage of identified threats.
- Ensure comprehensive Third-Party Risk Management (TPRM) coverage, including third and fourth-party risks.
- Monitor and maintain compliance management across the supply chain, tracking and resolving any outstanding compliance checks.

Key Performance Indicators (KPIs):

Risk Management:
- Average Vendor Security Rating: Measures the overall risk level within the vendor ecosystem. Analyze trends to identify and mitigate high-risk vendor relationships.
- % of Suppliers by Risk Tier: Enables strategic prioritization by visualizing risk distribution. Ensure granular risk tier distinctions for effective management.
- % of Providers Failing Initial Risk Assessment: Evaluates the efficacy of risk assessment processes, identifying areas for calibration.
- Mean Time to Complete Initial Risk Assessment: Analyzes vendor responsiveness and identifies potential process bottlenecks.
Threat Intelligence:
- % of Third-Parties Monitored with Threat Intelligence: Tracks the scope of monitoring coverage and identifies potential blind spots.
- Mean Time to Action (MTTA) After Risk Trigger: Assesses incident response efficiency and identifies training or resource gaps.
- Number of Incidents Reported/False Positives: Evaluates the effectiveness of threat detection and monitoring processes.
Compliance:
- Number of Third-Parties in Regulatory Scope: Identifies compliance focus areas and resource allocation needs.
- Number of Outstanding Compliance Requirements: Tracks and resolves compliance gaps, ensuring adherence to regulatory standards.
- Vendor Due Diligence Completion Rate: Monitors compliance progress and mitigates potential risks.
- Average Time Between Risk Assessments: Balances audit frequency to maintain vendor relationships and mitigate evolving risks.

TPRM Coverage:
- Mean Time to Onboard (MTTO): Evaluates the efficiency and thoroughness of the vendor onboarding process.
- % of Third-Parties Not Monitored: Identifies gaps in monitoring coverage, ensuring all high-risk vendors are observed.
- Number of Unboarded Suppliers on Payroll: Mitigates risks associated with unboarded suppliers.

Key Risk Indicators (KRIs) and Key Control Indicators (KCIs):

Utilize KRIs to proactively identify potential risks and vulnerabilities, including supplier financial stability, delivery performance, compliance, concentration, and geopolitical exposure.
Employ KCIs to monitor the effectiveness of risk mitigation controls, focusing on supplier audits, contractual compliance, supply chain visibility, incident response time, and training certification.

Procurement Lifecycle of Third-Party Risk Management

Third-Party Risk Management

External and Internal risks

Did you know ...

That according to the Global Cybersecurity Outlook 2024 report by the World Economic Forum, a shocking 98% of organizations report having at least one of their third-party partner has suffered a data breach in the last two years.

Also, according the IBM Cost of a Data Breach Report 2024, that the global average cost of a data breach has hit a record $4.88 million (4 479 840 euro). And according to Gartner around 60% of organizations now are managing over a 1 000 Third-Parties.

How to mitigate these challenges?

The Shifting Landscape of Cybersecurity Threats

Supply chain attacks are no longer theoretical; they are a tangible threat, leveraging vendor access to bypass traditional security defenses. Without proactive measures, the privileged access granted to third-party vendors, operating outside direct security control, becomes a significant vector for data breaches and malicious attacks.

Third-Party Risk Oversight

Thousands of third-party relationships, each with unique risks, overwhelm traditional oversight. This lack of visibility, compounded by fourth-party and multi-jurisdictional complexities, creates critical vulnerabilities in financial stability, operational resilience, and subcontractor management.

Governance Compliance

The regulatory landscape is in constant flux, posing significant compliance challenges for organizations. Frameworks like DORA, APRA, and ABAC are shaping a complex web of requirements, demanding adherence to diverse data-protection standards and risk reporting protocols across multiple jurisdictions.

To counteract this we should in our approach focus on identifying and closing these security gaps through:

Implement comprehensive Due Diligence before onboarding new vendors, verifying their cybersecurity certifications (e.g. ISO 27001 or NIST).
Automate the onboarding workflows.
Create a compliance checklist for vendors including applicable data protection regulations.
Conduct regular audits.
Ensure vendors comply with relevant security and compliance standards (e.g., ISO 27001, NIST, GDPR, HIPAA).
Establish cybersecurity training programs for all third-party vendors and internal staff.
Deploy continuous monitoring tools (SLA's, KPI's, KRI's and KCI's) to detect and mitigate threats in real time and keep track of them on a Third-Party Risk Dashboard (examples of metrics are shown earlier).
Combine industry-standard frameworks, such as NIST or ISO 27001, with tailored assessments to conduct a thorough evaluation of vendors, ensuring risk alignment with your organization's specific exposure profile.
The regulatory landscape is in constant flux, posing significant compliance challenges for organizations. Frameworks like DORA, APRA, and ABAC are shaping a complex web of requirements, demanding adherence to diverse data-protection standards and risk reporting protocols across multiple jurisdictions.
Make use of a vendor risk scoring system or a Risk Heat Map.
Automate the onboarding and assessment workflows.
Use a centralized vendor portal.
Integrate CSI (Continual Service Improvement) principles.
Automate threat detection and response processes to eliminate inefficiencies and accelerate mitigation.

SIAM, ITIL, ITSM, Agile, Lean .....?

SIAM (Service Integration and Management) isn't just ITSM (IT Service Management), they share the same principles, collaborative dynamics, and the mutual reinforcement that drives efficient, customer-focused service delivery. SIAM is build on mature ITSM practices, as well as it uses key ITIL processes and Agile and Lean approaches. Their synergistic relationship enhances the delivery and coordination of IT services.

The difference is that a SIAM approach means to manage the integration and coordination of multiple service providers in a complex, multi-supplier ecosystem. It emphasizes governance, collaboration, and accountability across various suppliers to ensure unified service delivery.

Example of an analysis of a Third-Party

Third-Party analysis: comparing against renegotiation, alternative vendors, and in-house solutions.

Just a mock-up with no real data.