Cyber Security Third Party Risk

A comprehensive guide to cyber security third party risk

Created byGeoff Shaw

Last updated 5/2025

English

What you'll learn

Gain a comprehensive understanding of Cyber Security Third Party Risk
Understand the regulatory and business drivers for managing cyber security third party risk
Understand inherent risk and how to use it to prioritise or tier third parties for review
Gain insights into conducting effective due diligence of a third party's cyber security practices
Learn tips on how to effectively deal with third party risks identified following the review

Course content

8 sections • 26 lectures • 2h 18m total length

Welcome3:23
In this lecture I’ll introduce the course, explain its benefits and discuss the target audience.
Course Structure5:29
In this lecture I will provide a summary of the course structure and give you a “taster” of each section.

Cyber Background4:37
In this lecture I will the background story to “Cyber”, starting with “computer security” and providing the current context for cyber within third party risk.
Third Party Risk5:02
Due Diligence2:02
In this lecture I will explain the important concept of due diligence, as the key approach to assessing the cyber capability of your organisation’s third parties.
Third Party Breaches8:35
In the last lecture in this section I will provide examples of several high profile security breaches attributed to third party cyber weaknesses. I will provide some takeaways common issues with these real world examples.
Overview & background

GDPR10:48
The first lecture in this topic focusses on explaining the GDPR requirements relating to use of third parties. For most UK and EU organisations, and any handling EU personal data, this will be the most prevalent regulation to mandate assessing cyber third party risk.
DORA (Digital Operational Resilience Act)3:36
This lecture explains this new EU regulation, because it mandates rigorous assessments of a vendor's cybersecurity posture, making it crucial to evaluate potential risks when engaging with third-party providers.
Network and Information Systems Directive (NIS 2)4:32
This lecture explains the regulation which is considered the first EU-wide law focused on cyber security for a range of critical industry sectors and critical service providers.
Information Security Standards - Cyber Essentials and ISO 270016:42
In the first of two lectures on security standards, I will cover Cyber Essentials and ISO 27001. You will learn about the basics of these standards, certification and interpreting the certificates for your third party risk reviews.
Information Security Standards - PCI DSS4:25
In the second lecture on security standards, you will learn the basics about the Payment Card Industry Data Security Standard, which is relevant to many third parties. I will also discuss the differences between third parties aligning with standards and gaining certification.
Regulations & standards

Introduction and Service Description7:16
I will explain why assessing the inherent risk of a third party is important for your organisation, as a pre-curser to due diligence, and how details of the service provided, and use of the “CIA Triad” contribute to this assessment.
Access to Systems4:51
Learn about how the access that third parties have to your organisation’s systems contributes towards the inherent risk assessment.
Examples7:35
In this lecture I will provide several examples of third parties from different industry sectors and show how their inherent risk can be been assessed.
Inherent Risk Assessment

Objectives4:43
In this lecture, the first of several of this topic, I will discuss how to choose an appropriate level of due diligence based on the inherent risk outcome.
Shared Assessments2:17
In this lecture I will discuss use of the widespread SIG or “Standardized Information Gathering” questionnaire from the Shared Assessments organization.
Security Ratings3:17
In this lecture I will explain the benefits of using Security Ratings tools in your third party due diligence.
SOC Reports Part 1 (background)4:28
In the first of three lectures on SOC 2 reports I will explain the background, usage and relevant terminology surrounding SOC reports, and why SOC 2 reports are usually very beneficial to your organisation’s third party due diligence review.
SOC Reports Part 2 (report structure)8:14
In the second of the three lectures on SOC 2 reports, you will learn about the structure of the SOC 2 report, the 5 Trust Service Criteria, and shown working examples of the various sections of the report
SOC Reports Part 3 (insights)2:42
In the last lecture on SOC 2 reports, I will provide some deeper insights into a report, checking its relevance to your organisation, and what things to look out for to get assurance about the report
Custom Questionnaires5:22
In this lecture I will provide some guidelines and tips in designing your organisation’s own third party cyber questionnaire, to elicit the best responses from your third parties.
Site Visits5:32
In the last lecture of this topic on due diligence I will explain the benefits of conducting a third party site visit, and planning tips to ensure you get the most out of the visit.
Due Diligence

Requirements

No prior knowledge of cyber security third party risk is required, however an understanding of cyber security or cyber risk would be helpful.

Description

Understand why Cyber Security Third Party Risk Management is so important for organisations and what steps your organisation needs to take.

You will get a firm grasp of the cyber security third party risk today’s organisations face and what steps organisations and industries like yours can take to help manage this risk and protect themselves.

· Gain a solid understanding of the background and context to Cyber Security Third Party Risk, by looking at the Cyber Security and Third Party Risk backgrounds, and how they “meld” together.

· Learn about the importance of cyber security third party risk for organisations, and see how some of the latest high profile security breaches on organisations have been a result of their third party relationships

· Learn how to assess cyber security third party risk associated with your suppliers and the services their provide. Understand the concepts of Inherent Risk how to assess this using "CIA Triad" of confidentiality , integrity and availability and how we can use these to prioritise due diligence activities.

· Learn what key standards and regulations require organisations to do regarding cyber security third party risk, including ISO 27000, PCI DSS, Cyber Essentials, the GDPR, DORA and NIS 2.

· Learn about the different approaches to undertake due diligence of your third party’s cyber security posture, including design tips for custom questionnaires, and how to gain the most from SOC 2 reports and third party ISO 27001 certifications.

· Learn about the importance of legal contracts in addressing cyber security third party risk, and the importance of contract negotiation

· Understand and see samples of the documentation your cyber security third party risk management programme will require including samples of policy, procedures and templates.

· Learn about the importance of communications with suppliers and key stakeholders during the cyber risk third party risk management lifecycle, and how to manage the remediation of gaps within your third party’s security controls measures.

Who this course is for:

Professionals in Information or Cyber Security
Procurement or sourcing teams, business stakeholders and others who own or manage the services and relationships with third parties
Students or graduates in a Cyber Security discipline, or IT professionals who wish to increase their knowledge of this highly relevant cyber security topic

Cyber Security Third Party Risk

What you'll learn

Explore related topics

Course content

Introduction2 lectures • 9min

Overview and Background4 lectures • 20min

Regulations and Standards5 lectures • 30min

Policy and Legal2 lectures • 13min

Inherent Risk Assessment3 lectures • 20min

Due Diligence8 lectures • 37min

Risk Treatment1 lecture • 9min

Conclusion and downloads1 lecture • 1min

Requirements

Description

Who this course is for: