‍‍Core Elements of a Cyber Risk Management Framework are:
Governance, Controls, Audits, Remediation, Contracts, Continuous Monitoring

A few questions which may reveal potential breaking points:Does your Board and C-Suite understand the risks to their data and their business?
Does your Board and C-Suite understand that security does not come for free?
Does your Board and C-Suite understand that a breach can bring down the entire company within very short time?
Are your Board and C-Suite integrated in the overall risk governance and do they actively endorse and support it?
Do you apply the same Governance, the same Controls, the same Scrutiny to Third Parties and their entire Supply Chain?
How effectively do you enforce controls, including strict auditing and remediation on your Third Parties and their entire Supply Chain, in particular when Business is demanding fast adoption of a service?
Are you equipped to continuously monitor all services processing your sensitive data and to immediately trigger sanctions in case of services failing to ensure compliance in operation?

Cyber Risk Governance: Core Aspects:
Integrated governance: Business, Risk, CIO, CTO, DPO, 2nd Line of Defence, Audit, SOC, Cloud Operations
Defined Cloud Strategy
Centrally driven 3rd / nth Party Risk & Compliance Governance
Link to Regulatory Compliance
Enforce Regulatory Requirements across supply chain, including Right to Audit, 24h notification
Educate! What can happen if…
Architecture and technical standards compliance
Risk and controls compliance
Operational suitability and operating standards compliance
Operational KPC(i)s and Risk Management Monitoring and Sanctioning
SOC and Cloud Operations monitor all Third Parties and their entire Supply Chain
Centrally managed concentration risk, including Third Parties and all of their Supply Chain
‍
Controls required to ensure Governance can be effective:
CISO / DISO / DPO / 2nd LoD agreed Cloud Requirements
Leveraging a standard Cloud Controls Framework e.g. CSA CCM
Augmented for Controls required for CID, PII All regulatory requirements translated into controls
Shared Accountabilities defined
Right to Audit enforced
Pen testing enforced
24h notification from when breach occurred to customer no matter where in the Supply Chain
Threat & Vulnerability Mgmt. plus Incident Response Capability at each level in Supply Chain
SOC, Incident Management capabilities and log monitoring fully integrated across all Third Parties and their entire Supply Chain up to the customer. Your SOC must be able to real time access and monitor the logs and incident details of your entire Supply Chain.
Joint BRM / BCR testing all Third Parties and their entire Supply Chain for all critical services.
Joint incident / response exercises
The 12 Golden Controls:
Temporary Privileged Access Management
Multi-Factor Authentication
HSM backed key vault with Customer Specific Keys
Unstructured data classification and encryption and DLP
Log immutability
Records immutability
Jurisdiction specific storage and processing
Data segregation by customer

Audits to evaluate controls compliance:
Assessment of Third Party Services and all of their sub-service providers’ services via controls not questions
Evidence must be submitted, reviewed and challenged. No evidence = finding
Control failures or gaps result in findings
Operational effectiveness failures result in findings:
Pen test failures / results
Joint BCM / BCR exercise failuresJoint incident / response exercise findings / failures
SOC interoperability failures during continuous monitoring
Enforce & exercise the Right to Audit across the entire Supply Chain, incl. all sub-providers
Third Party service providers must evidence effective control of every sub-service provider for control adherence
If the Third Party service provider cannot ensure their Supply Chain compliance, you must ensure control adherence across the Third Parties’ Supply Chain
ISO 27001 / 17 is configurable, not transparent as you do not get the detailed report, no remediation enforced.
SOC2 Type 2 is transparently audited and fully reported but it is configurable. You MUST get and yourself audit the report.
‍
Ensure control failures by Third Party Service Providers and their Supply Chain are flagged and remediated:
Findings must be remediated
Remediation requires design proposals which are reviewed, challenged for effectively addressing the finding
Closure of finding requires evidence of effective remediation and positive re-assessment of control
No remediation = no deal / exit from contract
Inappropriate remediation = back to square one / contract breach

Contracts that protect you, not your Third Parties:
Tight standard clauses for information security and data protection
Applied to Third Party service providers and mandated to be enforced by the Third Party Service Providers across the entire Supply Chain of sub-providers
Right to Audit across entire supply chain. Attention: Several jurisdictions restrict enforceability of the the Right to Audit, ensure your contracts are concluded under a legislation permitting to execute your Right to Audit!
24h breach notification overall: The 24h breach notification is interpreted by several regulators to apply from the breach occurring, no matter how deep the Supply Chain is.
Contract conditions of nth level sub-contractor with their Supply Chain impact threat and incident management capabilities of your Third Party service provider and yourself.
Every finding results in remediation clauses
Exit clause triggered by inappropriate remediation or breach
Contract performance is conditional on information security controls being met continuously and across entire Supply Chain

Continuous Monitoring:
YOU must have the capabilities to continuously monitor your Third Party service providers' threat & vulnerability management and their incident response process effectiveness, including their Supply Chain of sub-service providers.
Requires permanent, open and real time access to your Third Party service providers' logs, including their Supply Chain sub-service providers’ logs..
Requires link between your and the Third Party service providers’ SOCs., and their sub-service providers’ SOCs.
Your Third Party service providers and entire Supply Chain must have own threat, vulnerability & incident management capabilities.
Requires chain of KPC(i)s linked and rolling up across the entire Supply Chain, to the Third Party service providers and yourself
NO reliance on Cloud Service Provider threat & vulnerability management / incident management alone.

‍