Some key findings:

Third-party cyber risk is driving key business decisions. Nearly 97% of respondents said cyberrisk affecting third parties is a major issue. Meanwhile, nearly 80% of respondents said they have terminated or would decline a business relationship due to a vendor's cybersecurity performance. One in ten organizations has a role specifically dedicated to vendor, third-party or supplier risk.
There is a lack of consistent third-party risk measurement and reporting. Only 44% of respondents reported on this risk to their executives and boards on a regular basis. This lack of regular reporting suggested why nearly 20% of respondents think boards and executives are not confident or do not understand their approaches to third-party risk management.
A majority of organizations aren't using critical tools. Respondents reported they still rely on tools like annual on-site assessments, questionnaires and facility tours to assess third-party security posture, giving them limited visibility into their third-party cyber risk. Twenty- percent of organizations currently use a security ratings service to continuously monitor the cybersecurity performance of third parties, though 30% are currently evaluating security ratings providers.

Andreas Simou, managing director at CeFPro said. "Although there has been a significant increase in effectiveness, attention, and resources focused toward third-party cyberrisk over the last few years, there is still much to be done; utilizing more effective tools and techniques to overcome the ever-increasing challenges faced within the industry."

Instant Insights /

Financial Sector Study Shows Deep Concern About Third-Party Cyberrisks

Related Stories

Recommended For You