The importance of third party technology due diligence · 2019-07-02 · The importance of third...
2
PwC The importance of third party technology due diligence Businesses continue to explore and expand their use of third-parties to deliver cost efficiency dividends, scale, access to capabilities and capacity to free up existing resources to focus on more strategic value adding initiatives. While the use of third parties can bring key cost and scalability benefits, there are also risks to the confidentiality, integrity and availability of data handled by external parties as well as resilience risk and continuity of service that need to be considered. The importance of technology risk arising from the use of third parties is critical in today's data driven digital organisation. Key challenges How we can help? Areas in focus – knowing your risks considerations Of Australian Boards have a clear understanding of where their company’s key information or data assets are shared with third parties ASX Cyber Health Check Report – April 2017 11% 48% Of IT services are delivered by the cloud PwC, CIO, and CSO, The Global State of Information Security Survey 2017, October 5, 20161 $4m The average cost of data breaches PwC, CIO, and CSO, The Global State of Information Security Survey 2017, October 5, 2016 2. Completeness of third party lists Do you have visibility of your Third party providers and their risk profile? 6. Information asset classification Are all your information assets identified & classified consistently, including those managed by third party third parties? 1. Do you have a formalised risk based assessment approach for assessing technology risks up front prior to executing the contract including all categories of technology risk and not just security? 4. Do you have assessment frameworks and tools in place? E.g., Stratification engine, controls frameworks, etc. 7. Are you providing reporting and perspective on risk back to the organisation to drive ongoing change 5. Does your ongoing monitoring approach cover a mix of design and operational effectiveness testing? Below are some key statistics from our recent global surveys which demonstrates the criticality of having an effective third party security risk management program For a number of years we have partnered with some of Australia's largest organisations to deliver third party security assessments locally and globally. Through this experience, we have matured and evolved our service offering to create to create a data-driven digital platform that offers end-to-end management of third party security assessments. Its application can also cover broader third party risk management. Our third party assessment platform can also be augmented by the services of our mature offshore delivery capability to cost effectively execute third party assessments. 3. Do you have a standard set of technology clauses that are included in each third party contract?
Transcript of The importance of third party technology due diligence · 2019-07-02 · The importance of third...
PwC
The importance of third party technology due diligence
Businesses continue to explore and expand their use of third-parties to deliver cost efficiency dividends, scale, access to capabilities and capacity to free up existing resources to focus on more strategic value adding initiatives.
While the use of third parties can bring key cost and scalability benefits, there are also risks to the confidentiality, integrity and availability of data handled by external parties as well as resilience risk and continuity of service that need to be considered.
The importance of technology risk arising from the use of third parties is critical in today's data driven digital organisation.
Key challenges
How we can help?
Areas in focus – knowing your risks considerations
Of Australian Boards have a clear understanding of where their company’s key information or data assets are shared with third partiesASX Cyber Health Check Report – April 2017
11%
48% Of IT services are delivered by the cloudPwC, CIO, and CSO, The Global State of Information Security Survey 2017, October 5, 20161
$4m The average cost of data breachesPwC, CIO, and CSO, The Global State of Information Security Survey 2017, October 5, 2016
2. Completeness of third party listsDo you have visibility of your Thirdparty providers and their risk profile?
6. Information asset classificationAre all your information assetsidentified & classified consistently,including those managed by thirdparty third parties?
1. Do you have a formalised riskbased assessment approach forassessing technology risks up frontprior to executing the contractincluding all categories of technologyrisk and not just security? 4. Do you have assessment
frameworks and tools in place?E.g., Stratification engine, controlsframeworks, etc.
7. Are you providing reporting and perspective on risk back to the organisationto drive ongoing change
5. Does your ongoing monitoringapproach cover a mix of design andoperational effectiveness testing?
Below are some key statistics from our recent global surveys which demonstrates the criticality of having an effective third party security risk management program
For a number of years we have partnered with some of Australia's largest organisations to deliver third party security assessments locally and globally.
Through this experience, we have matured and evolved our service offering to create to create a data-driven digital platform that offers end-to-end management of third party security assessments. Its application can also cover broader third party risk management.
Our third party assessment platform can also be augmented by the services of our mature offshore delivery capability to cost effectively execute third party assessments.
3. Do you have a standard set oftechnology clauses that are includedin each third party contract?
PwC
We utilise an innovative solution which we believe is the future for third party assessments – helping you draw meaningful insights from the data gathered, maintain oversight of the issue management process and access benchmarking.
PwC’s third party assessments – A digital experience
Welcome
Online assessment
Progress tracker
Issue management
Analytics
Reporting
Manage assessments
online with the ability to upload
supporting documentation
via PwC’s web-enabled
digital platform, Datapoint.
Monitor Resolve Analyse ReportManage
Benefits
Real-time progress tracking across
multiple third parties.
Manage issues raised and establish
resolution deadlines with the
ability to track progress
Features
Access advanced data
analytics, interactive
visualisations and
benchmark across your third parties and controls
On-demand access to third party
assessment reports
Create a high quality data asset about the security controls at your third parties
• Hosted in PwC AWSenvironment withinAustralia
• Simultaneous 24/7 multipleuser access with advancedaccess controls
Provide a centralised trusted source of information
Access meaningful insights, trends & patterns enabling data-driven decision making
High quality
Robust
Secure
Data-driven
Who to contact
Ross WiddowsDirectorDigital [email protected] 8266 1595
Sarah GibsonDirectorData [email protected] 8266 0170
© 2019 PricewaterhouseCoopers. All rights reserved.PwC refers to the Australia member firm, and may sometimes refer to the PwC network. Each member firm is a separate legal entity. Please see www.pwc.com/structure for further details.This content is for general information purposes only, and should not be used as a substitute for consultation with professional advisors.Liability limited by a scheme approved under Professional Standards Legislation.At PwC Australia our purpose is to build trust in society and solve important problems. We’re a network of firms in 158 countries with more than 236,000 people who are committed to delivering quality in assurance, advisory and tax services. Find out more and tell us what matters to you by visiting us at www.pwc.com.au.WL 127070380
Peter MalanPartnerDigital [email protected]
