Challenges & Needs

• No TPRM Program in Place: The client had little, if any, documented processes in terms of monitoring their growing list of third-parties. There was no real due-diligence performed when on-boarding third-parties, along with no continuous monitoring initiatives in place.
• No Documentation in Place. Along with having no formalized measures in place for TPRM, the client had essentially no documents in place regarding information security policies and procedures.
• Weak System of Internal Controls: The client also lacked formality and structure in terms of having a sound grasp of internal controls and how to establish, enforce, and monitor an actual system of internal controls.
• No Project Management Experience for Regulatory Compliance: None of the internal I.T. and operational staff had history of managing any type of meaningful compliance project.

Our Solution

• Met with senior leadership and provided a complete strategy and plan-of-attack for designing, deploying, and implementing a robust, results-driven TPRM program from the ground up.
• Met with key stakeholders within various departments/divisions, earning their acceptance and support for what would be an aggressive timeframe for project implementation and completion.
• Identified gaps and deficiencies within the client’s information security, cybersecurity, data privacy, and H.R. and operational control environment, offering expert recommendations on remediation and next-steps.
• Established contact and strong working relationships with all in-scope third-party vendors (i.e., managed security services providers)

Challenges Solved

• Implementation of a true TPRM framework that successfully captured all external suppliers.
• Developed all required TPRM policy documentation.
• Conducted in-house training to all stakeholders on how to execute the TPRM program to all external suppliers.

Value Created

• Put in place a corporate culture that now understands, respects, and truly values the concept of TPRM and the need for continuously monitoring all external suppliers.
• TPRM - and the broader topic of regulatory compliance - was now viewed in a multi-dimensional value proposition that not only helped with stronger information security, but with enhanced business development opportunities, and increased client satisfaction and other related measures.