Question 1

What is Third-Party Risk Management?

Accepted Answer

Third-Party Risk Management (TPRM) automatically monitors vendor risk exposure by pulling threat intelligence from OpenCTI. It scores vendors by sector and data sensitivity, triggers assessments when threat intel changes, and links vendor vulnerabilities to your Risk Register.

Question 2

How are vendor risk scores calculated?

Accepted Answer

Inherent risk score = sector baseline score × data sensitivity multiplier (PII: 1.5x, PHI: 1.8x, financial: 1.4x, none: 1.0x). Residual risk score = inherent score × (1 - control effectiveness from latest assessment). Scores are refreshed weekly using the latest threat intelligence.

Question 3

How does auto-population work?

Accepted Answer

The system scans OpenCTI for threat actors that target supply chains using keywords and MITRE TTPs. When a supply-chain threat actor is detected, a vendor risk entry is automatically created with the appropriate sector, data sensitivity classification, and risk score. Entries are deduplicated by name and sector.

The Resilience Stack™: A Five-Layer Framework for Cyber Insurance Risk Assessment

What Eclipse Ditto Security Gaps Mean for Your Cyber Policy

What HashiCorp Vault Security Gaps Mean for Your Cyber Policy

Third-Party Risk Management

Share this tool

How It Works

1. Threat Intel Ingestion

2. Risk Heat Map

3. Assessment Workflow

4. Risk Register Integration