This picks up where CRVPM ll left off and dives into the 3rd party risk management program framework and each stage of its lifecycle, demonstrating the business value that should be driven from it. If you’re trying to build a business case for further investment in your program or need to better understand whether you’re on track to attain the goals you hoped to achieve through outsourcing, this will help you identify and articulate the value proposition of a sound program.

All too often there is confusion as to the difference between an RFI (Request for Information) and an RFP (Request for Proposal) and when to use them. Many RFP’s are confusing, too broad, don’t differentiate between needs and wants, and are written to the strengths of one particular vendor. This ultimately results in a less than ideal proposed solution and the client (you) turns out being the loser. This chapter dives into the RFP process and covers the following:

• Gathering business requirements
• Constraining the Boundaries of the RFP
• Involving stakeholders
• Assembling the correct RFP team
• Creating transparency throughout the process
• Evaluating responses for a fair apples-to-apples comparison

Concentration Risk has been a formal regulatory issue but has only recently been a topic of examiner focus. Having all of your eggs in one vendor’s basket is never a good thing due to the huge impact it has on business resilience. However, there are many other facets of concentration risk to be concerned about as shown below.

• Systemic
• Vendor-based
• Service-based
• Geographic
• 4th Party
• Economic
• Sector-based
• Reverse Concentration Risk
• Socio-Political

Attempting to tackle the many facets of concentration risk is difficult without a framework and a set of business rules to flag concentration risk outside of the institution’s tolerances. This chapter dives into the types of concentration risk, vulnerabilities, mitigating controls and the development of a Unified Concentration Risk Framework (UCRF).

A hot topic everywhere that everyone should be concerned about! Are your vendors as prepared as you are? Within this chapter we discuss:

• Cyber Security Landscape
• Why we should worry
• Cyber Security vs Cyber
• Resilience vs Cyber Risk
• Mitigating controls (physical, technical, administrative, contractual)
• Approach to a 3rd Party Cyber Security Risk Assessment

The General Data Protection Regulation (GDPR) has been a highly visible topic given today’s global economy, data theft, and numerous standards for data privacy and protection. With the standardization of the General Data Protection Regulation throughput the European Union, this chapter dives into the Articles pertaining to Vendor Management, key elements, terms, basic principles, regulatory expectations and whether you should even be concerned about it based upon your business model and customer base.