Identifly CSO Highlights Overlooked Third-Party Risks in Cyber Compliance

What's Happening?

Aaron Finnis, Chief Strategy Officer at Identifly, has raised concerns about the current state of cyber compliance, particularly the oversight of third-party risks. Finnis notes that many organizations focus on completing detailed checklists for cybersecurity contracts, often neglecting practical processes that effectively reduce risk. He emphasizes the importance of regular, ongoing reviews to adapt to changing cyber postures as organizations grow. Finnis also points out common gaps in cybersecurity contracts, such as inadequate processes for managing access to customer assets and the lack of clauses for timely incident reporting. He advocates for clear requirements and independent assurance to verify partner controls, suggesting that contracts should go beyond insurance and liability to enforce key controls.

Why It's Important?

The oversight of third-party risks in cyber compliance can have significant implications for businesses and their cybersecurity posture. As organizations increasingly rely on third-party vendors, the potential for cyber incidents grows, making it crucial to address these risks comprehensively. Failure to do so can lead to vulnerabilities that may be exploited, resulting in data breaches and financial losses. By prioritizing practical processes and regular reviews, organizations can better protect their assets and ensure compliance with regulatory requirements. This approach not only strengthens cybersecurity but also builds trust with customers and partners, who expect robust protection of their data.

What's Next?

Organizations are likely to reassess their cybersecurity contracts to incorporate more comprehensive reviews and enforce key controls. As regulatory pressures increase, businesses may need to adapt their agreements to include clauses for timely incident reporting and independent assurance. This shift could lead to a more proactive approach in managing cyber risks, with a focus on continuous improvement and adaptation to evolving threats. Stakeholders, including business leaders and cybersecurity professionals, will need to collaborate to ensure that contracts align with both compliance requirements and practical risk management strategies.

Beyond the Headlines

The emphasis on third-party risks in cyber compliance highlights broader ethical and legal dimensions. Organizations must balance the need for stringent cybersecurity measures with respect for vendor liability limitations. This requires transparent communication and mutual understanding between partners. Additionally, the evolving landscape of cyber threats necessitates a cultural shift towards prioritizing cybersecurity as a core business function, rather than a mere compliance checkbox. Long-term, this could lead to more integrated and resilient cybersecurity frameworks across industries.