Lesson 5.43: Third-party risk
Much of Northwind's data and access sits with suppliers: a payment processor, a support platform, a network contractor. Their weaknesses become Northwind's incidents, and NIS2 and ISO/IEC 27001 both expect supplier risk to be managed. The work is mostly reading carefully: which suppliers matter most, whether their reviews are current, whether what they claimed in a questionnaire matches their independent audit report, and what that report says the customer must do. In the lab you tier Northwind's suppliers and read PayFlow's SOC 2 Type II report against its questionnaire.
17 min
You will learn to
- Tier suppliers by data and access
- Find overdue reviews
- Compare questionnaire answers with audit evidence
- Read a SOC 2 Type II report's period, opinion and exceptions
- Identify complementary user entity controls
Key terms
- Third-party risk management (TPRM)
- Identifying and managing risks that come from suppliers and partners.
- Tiering
- Grouping suppliers by how much harm they could cause, to set review depth and frequency.
- SOC 2 Type II
- An independent auditor's report (AICPA) on a service organisation's controls, tested over a period.
- Exception
- A case where the auditor found a control didn't operate as described.
- Bridge letter
- A supplier's statement covering the time between the report period's end and today.
- CUEC
- Complementary user entity controls: what the customer must do for the supplier's controls to be effective.
← Breached passwords, passphrases and password managers · All lessons · Notification across jurisdictions →