Summary

At the beginning of this chapter, we learned about the risk posed by third-party entities and how it can be managed. We then learned about the importance of managing downstream as well as upstream third-party relationships. With the recent trends and an uptick in third-party attack vectors, risk managers should keep themselves abreast of the latest trends and ensure that the risk posed by these threat actors can be minimized by implementing a TPRM program. Next, we learned about issues, findings, and exceptions and the role of configuration, release, exception, and change management to manage these risks. Finally, we learned about the importance of CAB in approving these changes. The goal for risk practitioners is to strike a balance of security and usability without compromising the organization’s security goals.

In the next chapter, we will learn about control design and its implementation.