45% of firms disrupted by third-party issues despite cybersecurity investments.

December 28, 2023
1 min read

Key Points:

  • 45% of organizations have experienced business interruptions due to third-party factors within the past two years.
  • Successful third-party cybersecurity risk management relies on resource efficiency, risk management and resilience, and influence over business decision-making.

A recent survey by Gartner has found that despite extensive investment in third-party cybersecurity risk management (TPCRM), 45% of organizations have experienced business interruptions due to third-party factors within the past two years. This highlights an ongoing struggle for cybersecurity teams. Zachary Smith, Sr Principal Research at Gartner, commented that third-party cybersecurity risk management is often excessively process-oriented, resource-intense, and results are few and far between. Cybersecurity teams struggle to build resilience against third-party related disruptions and to influence third-party related business decisions.

The survey involved 376 senior executives who play a role in third-party cybersecurity risk management in their organizations. According to Gartner, successful TPCRM relies on an organization’s capability to deliver three key outcomes: resource efficiency, risk management and resilience, and influence over business decision-making. However, most companies struggle to effectively deliver two of the three outcomes, with only 6% of surveyed organizations being proficient in all three areas.

Gartner identified four actions that security and risk management leaders could implement to increase their effectiveness when managing third-party cybersecurity risk:

  1. Regularly review the effectiveness of communicating third-party risks to the relevant business owner of the third-party relationship.
  2. Track third-party contract decisions to aid in managing risk acceptance by business owners.
  3. Conduct third-party incident response planning, including playbooks and tabletop exercises.
  4. Collaborate with essential third parties to enhance their security risk management practices as needed.

Implementing any of these actions reportedly led to a notable 40-50% increase in TPCRM effectiveness.

In an interconnected business environment, the risk associated with a critical third party has a direct impact on the organization. Therefore, partnerships that foster transparency and collaboration in improving security risk management practices are beneficial.

Latest from Blog

Top CISA official looks back on four years of cyber work

TLDR: Eric Goldstein, a top official at CISA, reflects on progress made in cybersecurity during his tenure. Key achievements include understanding cyber risks, collaboration with industry, and encouraging secure product development. Eric

Juggling AI cybersecurity highs and lows

TLDR: At the 2024 MIT Sloan CIO Symposium, industry leaders discussed the challenge of balancing AI’s benefits with its security risks, particularly focusing on generative AI. While generative AI can bring benefits

Get your free Cyber Security eBook now Valued at $169

“`html TLDR: Key Points: Claim your complimentary eBook worth $169 for free before May 22. The eBook covers practical applications of cyber security and network security for professionals, engineers, scientists, and students.