Managing external services: vendors, cloud providers and fourth parties

Most organizations depend on outside providers for software, cloud infrastructure, payroll, customer support and many other services. Each provider that handles your data or connects to your systems extends your attack surface, and several major breaches have started at a supplier. Outsourcing transfers work, not accountability: regulators, customers and courts still hold you responsible for your data and services. Third-party risk management (TPRM) is how the information security program manages that exposure.