Third Party Governance Role:
. Vendor Risk Identification and Analysis:
Revise the Vendor Risk Assessment Playbook, Process, and Procedures to ensure they're up-to-date with industry practices.
Construct a risk assessment plan using a standardized approach to minimize the bank's exposure to third-party vendor risks.
b. Third Party Cyber Risk Assessments:
Analyse third-party cyber risk assessment documents and procedures to ensure comprehensive risk management.
Continually monitor and adapt to new risks, ensuring that assessment strategies are proactive.
c. Tools, Measurement, and Analysis:
Scrutinize and validate cyber tools and create test cases to assess the effectiveness of third-party cyber risk tools.
Optimize the use of JIRA for improved tracking and management of cyber assessments.
d. Program Governance Cyber PMO:
Establish a Cyber Program Management Office to oversee and align cyber risk projects with organizational goals.
Provide ongoing support for cyber risk initiatives and ensure effective communication among all stakeholders.
Vendor Risk Assessment and Mitigation
1. Walkthroughs and Understanding: Conducting in-depth sessions with application owners to comprehend the application architecture, services provided, and IT processes involved.
2. Assessment Scope and Connectivity: Defining the scope of the assessment and identifying how vendor services connect with the organizations existing architecture.
3. Questionnaire Distribution and Assistance: Tailoring assessment questionnaires based on vendor service applicability and facilitating stakeholders in completing them.
4. Evidence Review and Follow-ups: Reviewing the evidence provided by stakeholders and conducting follow-up meetings for clarification and understanding of responses.
5. Gap Analysis and Validation: Analysing the questionnaires to identify gaps and conducting validation sessions with stakeholders on the findings.
6. Risk Assessment Reporting: Compiling