Wrangling Third Party Cybersecurity Risk

11/30/23 • 30 min

CISO Edge, The Gartner Cybersecurity Podcast

Despite CISOs making meaningful increases in time, money and technology to third-party cyber risk management (TPCRM), enterprises continue to be plagued by disruptive third-party-originating cyber incidents. Chris Mixter and Rahul Balakrishnan use Gartner’s latest global benchmarking to debunk the conventional wisdom around TPCRM, which drives cybersecurity leaders to increase effort without improving outcomes. Chris and Rahul also provide three practices that CISOs can implement immediately to improve TPCRM effectiveness.

This episode explores:

Why cybersecurity should stop customizing due diligence questionnaires (06:20)
How to increase the likelihood that accepted third-party cyber risks become managed risks (13:30)
Making contingency planning a core element of third-party cyber risk management (21:45)

This episode explores:

Why cybersecurity should stop customizing due diligence questionnaires (06:20)
How to increase the likelihood that accepted third-party cyber risks become managed risks (13:30)
Making contingency planning a core element of third-party cyber risk management (21:45)

Previous Episode

Identity-First Security–Are You Ready?

In this episode of the CISO Edge podcast series, Gartner experts Mary Ruddy and Chris Mixter explore what cybersecurity leaders across the spectrum of identity and access management maturity need to do to accelerate their progress to an identity-first cybersecurity program. Decentralization of computing resources, channels, entities and devices makes traditional perimeter-based security strategies and tools insufficient. Security and risk management leaders must put identity at the core of cybersecurity strategy and invest in continuous, context-aware controls. However, getting to a level of IAM program maturity where you are able to deliver continuous, context-aware identity and access controls at scale feels like a massive leap to many CISOs, whose IAM programs struggle to deliver their basic capabilities at a consistent level of quality. This conversation will provide guidance to CISOs to enable their IAM teams to rapidly advance down the path to identity-first security.

Next Episode

CISOs, Your Chief Deliverable Is Trust, Not Security!

CISOs today are taking on more responsibilities and doing so faster. However, this rapid expansion comes at the cost of stability and amorphous priorities. CISO Edge podcast host Chris Mixter talks to Gartner VP analyst Nader Henein about trust — who needs to trust CISOs, what trust means to each constituency, and how CISOs can build trust with each one.

This episode explores :

The connection between trust and the CISO’s effectiveness in role. (02:00)
What trust means to the C-suite and board in the context of cybersecurity (07:30)
What trust means to the CISO’s peers around the organization. (16:15)
How CISOs should build and maintain trust with their direct reports. (23:00)
How CISOs can support the development of trust from the organization’s customers. (29:24)