Every third party risk questionnaire I've reviewed this year has come back the same way: certificate…
Christian T. — Fractional CISO | Strategic Cyber, Technology & AI Advisor | Founder, Alvearium Associates
Every third party risk questionnaire I've reviewed this year has come back the same way: certificate attached, every box marked yes, and remarkably little curiosity about what actually happens behind either. Ticking a box because a supplier holds ISO 27001 is not due diligence, it is paperwork with good posture.
The uncomfortable truth is that most breaches now start three suppliers down, in a system nobody on your side has ever looked at, run by a vendor your vendor forgot to mention. Pragmatic third party risk management is not about collecting more attestations. It is about knowing which five suppliers would actually hurt you if they were compromised tomorrow, and treating those five differently from the rest of the pile.
Worth asking which five yours are.
5 reactions · 0 comments