How to Enhance Your TPRM Through Staff Augmentation

If you’ve seen the news lately, you know that breaches stemming from third-party vendors are on the rise, and it seems no organization is truly safe. Whether you’re still actively contracted with a third party or have ceased providing services, recent incidents prove you’re still at risk, making effective third-party risk management (TPRM) a must to avoid what could be disastrous consequences.  

However, some organizations don’t have the resources or in-house expertise to maintain that full-time, and many are instead turning to staff augmentation—which could be the right solution for you even if you do have the internal capabilities.  

As cybersecurity and compliance experts, we know exactly how important it is to manage your third-party risk and ensure your vendors are secure, but the concept of augmenting your staff to do so isn’t all that well-known. To help you understand more of how it works, in this article, we’ll first establish what TPRM entails before we get into staff augmentation and how you can decide whether it’s the right solution for your TPRM needs. 

What is Third-Party Risk Management (TPRM) and Why Is It Important? 

Imagine you own a multi-billion dollar company that sells tools, construction products, appliances, and bathroom and kitchen fixtures. As a trusted source for millions of Americans for their home improvement needs, business is booming until—out of nowhere—you learn that your system has been infiltrated and that the attackers used stolen credentials from a third-party vendor of yours to install malware on your point-of-sale system and skim payment card information. Millions of your customers' credit card accounts and email addresses are leaked, creating massive financial and reputational fallout. 

For Home Depot leadership, that wasn’t hypothetical—such a catastrophic breach occurred in 2014, as a result of their insufficient third-party risk management, which is a perfect segue into our explanation of the critical importance of implementing robust security measures for third-party vendors. 

In that, let’s start at the beginning. According to Shared Assessments, “third-party risk management (also called vendor risk management or VRM) is the practice of evaluating and both before establishing a business relationship and during the business partnership.” Because your third parties typically have access to your systems, resources, and sensitive data—such as personally identifiable information (PII), protected health information (PHI), credit card information, etc.—it’s imperative that you make an effort to create an effective TPRM program and protect yourself from the vulnerabilities that access creates. 

If you need more convincing, understand that the infiltration of Home Depot wasn’t an outlier—other recent and related breaches include those at: 

• SolarWinds: In 2020, hackers broke into SolarWinds’ software updates, leading to unauthorized access to high-profile networks and sensitive data. 
• Target: In 2013, hackers exploited credentials stolen from the popular retail organization’s third-party HVAC vendor, compromising millions of customers' personal and credit/debit card information. 

And it’s not just that other corporations are falling victim—regulators are also taking note of increasing third-party risk, as evidenced in the adjustments to compliance standards and the passage of new laws addressing vendor risk. One such regulation is the new Securities and Exchange Commission’s (SEC) Cyber Disclosure Rule, which requires public companies to report third-party cybersecurity incidents that could materially impact the organization within four business days. 

Given the current landscape of threats and governance, it’s become critical for all organizations to build a robust third-party risk management program, as those that do not could face investor lawsuits, SEC enforcement actions, and reputational damage (among other consequences). 

Getting Started with Third-Party Risk Management 

That being said, managing and executing a TPRM program is an art—a delicate balance between managing: 

• What vendors you engage  
• The onboarding process—including what type of information and access each vendor should get  
• Regular assessments of each vendor to ensure that they’re meeting your organization’s standards
• Withdrawal of access once your relationship with a vendor has been terminated

Here are some baseline tips regarding each of these facets of TPRM: 

The Advantages of Using Staff Augmentation for Your TPRM 

Of course, creating and maintaining these processes year-round and full-time isn’t always feasible. Whether you’re entirely resource-strapped or can only lend personnel in other roles to TPRM in a “get to it when you can” way, each scenario opens you up to potential fallout stemming from your vendors. However, there is another solution—you can engage experts to supplement your staff and shore up your TPRM. 

Staff augmentation—or, augmenting the capacity of your organization to support a need or an objective—is an outsourcing strategy that can be extremely advantageous. Instead of hiring full-time employees to manage your third-party relationships, you can hire external professionals, contractors, or consultants to do so as they work alongside your internal staff.  

Though it may sound unorthodox, there are several other advantages to taking this avenue:   

1. Cost-Effectiveness:
   In bringing on an external resource rather than hiring someone full-time, you’ll be able to put someone in this critical role without providing full-time salary, benefits, or training.  
   
   
2. Scalability:
   Staff augmentation allows you to rapidly deploy a workforce to address your TPRM needs. 
   
   
3. Expert Knowledge: 
   You’ll be able to access specialized individuals who can fill or boost knowledge/skill gaps on demand without any long-term commitments. 

We previously established that without sound TPRM practices, organizations face increased vulnerability to data breaches, risking the exposure of sensitive information and possible legal consequences— including substantial fines reaching millions of dollars. But through staff augmentation and the benefits it provides, you can fortify organizational resilience and: 

• Safeguard your assets 
• Protect your reputation 
• Maintain financial stability  
• Ensure operational continuity  

Next Steps Toward Stronger Third-Party Risk Management 

Even though you now understand more about TPRM and its importance and advantages, you’ll still need to evaluate whether it’s the right path for your organization. You can do that by asking and answering the following questions: 

• Is there sufficient staffing to support your TPRM program? 
• Among that staff, do they lack the knowledge necessary to build up your TPRM to a satisfactory and effective level? 
• If your onboarding process for full-time employees is challenging, could those delays affect your TPRM? 
• Do you currently engage many vendors and is their number likely to increase? 

If your answer to any of those last three is yes, you may want to explore staff augmentation to support your TPRM objectives. As a qualified and authorized third-party assessor organization (3PAO), Schellman does offer this service—our personnel can help in developing your TPRM roadmap and supporting your initiative to assess your third-party vendors in a way that’s fully aligned with your business needs and budgetary requirements. 

To learn more about Schellman’s TPRM services and what a potential partnership between our two organizations would look like, contact us today.  

In the meantime, discover other helpful insights about TPRM in these additional resources:  

• How to Improve Your TPRM with External Assistance and Validation 
• What is Third-Party Risk Management and Why Does It Matter? 
• ISO 27001 Third-Party Risk Management Requirements