1Continuous Monitoring
Continuous monitoring is the process and technology used to detect compliance and risk issues in real time, as opposed to point-in-time assessments. It provides a constant overview of an organization’s own network and that of its vendors, observing any potential vulnerabilities.
2Due Diligence
Due diligence is the investigation or assessment that a business is expected to take before entering into an agreement or contract with another party. In the context of third-party risk management (TPRM), due diligence involves requesting a prospective vendor to answer questions about their security policies and procedures, and provide evidence of a robust security posture.
3Enterprise Risk Management
Enterprise risk management is a comprehensive approach to risk management that comprises people, processes, and systems across an organization to improve performance against risks or threats.
4Governance, Risk and Compliance (GRC)
GRC is the integrated collection of capabilities to reliably achieve objectives, address uncertainty and act with integrity while operating a business. GRC activities can be conducted in areas such as internal audit, compliance, risk, legal, procurement, finance, IT, HR as well as at the executive level.
5Inherent Risk
Inherent risk is the threat a certain element, such as a third party vendor, poses to the organization before executing any mitigation activities. It takes into account how a company is using their third parties, including but not limited to, the levels of engagement with the third party, the amount and types of data shared.
6Risk Assessment
A risk assessment is the evaluation of potential risks that may be involved in a projected activity or undertaking. In the context of third party risk management (TPRM), risk assessments are conducted to evaluate a vendor’s security posture before signing a contract with them and throughout the business relationship.
7Security Questionnaire
A security questionnaire is a sequence of questions to evaluate and validate a third party vendor’s security practices before choosing to do business with that organization. Security questionnaires can be custom-made or based on industry standards, such SIG by Shared Assessments.
8Third Party
A third party is any entity or person that works on behalf of an organization or that provides goods and services to other entities. They can offer business to business (B2B), business to customers (B2C) and business to government (B2G) business models. Third parties include consultants, clients, business partners, service providers, contractors, subcontractors, vendors, suppliers, affiliates, and more. While often used interchangeably, ‘third party’ is a broader term than ‘vendor’.
9Third Party Data Breach
A data breach is the compromise and intentional or unintentional release of private/confidential information to unauthorized parties. It can result in the data being copied, transmitted, stolen or used with other malicious intentions. A data breach can occur within an organization's system, or through that of its third party vendors, causing a third party data breach.
10Third Party Risk Management
Third party risk management is the process of identifying, analyzing and controlling risks presented to an organization by its third parties, including vendors, suppliers, contractors, customers or regulators. Often called TPRM, it involves: collecting critical third party information to assess their security posture; understanding what systems or information they have access to and the risk they pose to the organization; ensuring they comply with internal and external regulations; and monitoring any changes in their security procedures over time.
