9 min read
Running Third-Party Risk Management in Practice
Most third-party risk programs are a spreadsheet of questionnaires nobody reads after they are collected. How to build a tiered, continuously monitored program that genuinely reduces vendor risk, and what CPS 230 and DORA now expect of it.