Third Party Governance Role:
. Vendor Risk Identification and Analysis:
• Revise the Vendor Risk Assessment Playbook, Process, and Procedures to ensure they're up-to-date with industry practices.
• Construct a risk assessment plan using a standardized approach to minimize the bank's exposure to third-party vendor risks.
b. Third Party Cyber Risk Assessments:
• Analyse third-party cyber risk assessment documents and procedures to ensure comprehensive risk management.
• Continually monitor and adapt to new risks, ensuring that assessment strategies are proactive.
c. Tools, Measurement, and Analysis:
• Scrutinize and validate cyber tools and create test cases to assess the effectiveness of third-party cyber risk tools.
• Optimize the use of JIRA for improved tracking and management of cyber assessments.
d. Program Governance – Cyber PMO:
• Establish a Cyber Program Management Office to oversee and align cyber risk projects with organizational goals.
• Provide ongoing support for cyber risk initiatives and ensure effective communication among all stakeholders.
Vendor Risk Assessment and Mitigation
1. Walkthroughs and Understanding: Conducting in-depth sessions with application owners to comprehend the application architecture, services provided, and IT processes involved.
2. Assessment Scope and Connectivity: Defining the scope of the assessment and identifying how vendor services connect with the organization’s existing architecture.
3. Questionnaire Distribution and Assistance: Tailoring assessment questionnaires based on vendor service applicability and facilitating stakeholders in completing them.
4. Evidence Review and Follow-ups: Reviewing the evidence provided by stakeholders and conducting follow-up meetings for clarification and understanding of responses.
5. Gap Analysis and Validation: Analysing the questionnaires to identify gaps and conducting validation sessions with stakeholders on the findings.
6. Risk Assessment Reporting: Compiling