Mitigating Critical Third-Party Risk

Post-COVID surveys point to the increasing prioritization of organizational resilience and business continuity management, amidst escalating threats, such as supply chain disruption, geopolitical conflict, data breaches, and severe weather events.

However, another risk vector has emerged, threatening to undercut narrow gains eked out from organizational resilience programs. And that risk stems from the staggering rise in dependence on third parties for critical business activities.

Indeed, firms across all major sectors are becoming increasingly reliant on third parties for the delivery of critical functions and services.

Why’s that? Well, the benefits of these third-party arrangements are obvious to all. Many of the services in question, particularly cloud-based providers (CSPs) and information and communications technology (ICT) platforms, enable digital transformation, catalyze innovation, and provide greater resilience than a host- firm’s own technology infrastructure.

Many of these services, though, create single points of failure. And the failure of critical third parties has cascading effects on the availability of host-party services.

Regulators, for their part, have noticed the interdependence of the firms they regulate with third-party vendors, as well.