Effective Security & Compliance Insights

SOC 2 CC9.2: Vendor and Business Partner Risk Management

SOC 2 CC9.2 is the vendor and business partner risk criterion: it requires an organization to assess and manage the risks that come from the third...

Third Party Risk Management (TPRM): What It Is and How to Build a Program

Third party risk management (TPRM) is the discipline of identifying, assessing, and controlling the risks that come from the external organizations a...

SOC 2 Risk Management for Hybrid and On-Prem Environments

TL;DR

• Risk management maps to CC3.2 (risk identification and analysis), CC3.3 (fraud risk), and CC3.4 (changes that affect internal control)
• On-prem...

Supply Chain Risk Management Under CPCSC

For most of the history of Canadian defence procurement, cybersecurity obligations ended at the prime contractor's perimeter. A prime could hold a...