In_PRP today_AV0 's_POS fast-moving_AJ0 global_AJ0 economy_NN1 ,_PUN organizations_NN2 are_VBB finding_VVG themselves_PNX increasingly_AV0 reliant_AJ0 on_PRP third-party_AJ0 partnerships_NN2 to_TO0 remain_VVI competitive_AJ0 ._SENT This_DT0 is_VBZ particularly_AV0 true_AJ0 in_PRP financial_AJ0 services_NN2 ,_PUN manufacturing_NN1 ,_PUN health_NN1 care_NN1 and_CJC other_AJ0 sectors_NN2 that_CJT are_VBB highly_AV0 interconnected_VVN ,_PUN which_DTQ makes_VVZ them_PNP susceptible_AJ0 to_TO0 supply_VVI chain_NN1 risks_NN2 ._SENT 
The_AT0 SolarWinds_NP0 and_CJC Microsoft_NP0 Exchange_NN1 breaches_NN2 revealed_VVD that_CJT even_AV0 organizations_NN2 with_PRP the_AT0 most_AV0 mature_AJ0 security_NN1 programs_NN2 are_VBB at_PRP risk_NN1 because_CJS of_PRF their_DPS reliance_NN1 on_PRP third_ORD parties_NN2 ._SENT These_DT0 security_NN1 events_NN2 should_VM0 serve_VVI as_PRP a_AT0 wake-up_NN1 call_NN1 for_PRP companies_NN2 to_TO0 strengthen_VVI their_DPS third-party_AJ0 risk_NN1 management_NN1 (_PUL TPRM_NP0 )_PUR programs_NN2 and_CJC make_VVB them_PNP more_AV0 intelligent_AJ0 and_CJC responsive_AJ0 to_PRP today_AV0 's_POS growing_AJ0 risk_NN1 environment_NN1 ._SENT 
Risk_NN1 managers_NN2 can_VM0 leverage_NN1 new_AJ0 advanced_AJ0 technologies_NN2 to_TO0 apply_VVI a_AT0 greater_AJC level_NN1 of_PRF automation_NN1 and_CJC intelligence_NN1 to_PRP highly_AV0 manual_AJ0 TPRM_NN1 processes_NN2 ._SENT Cognitive_AJ0 computing_NN1 technologies_NN2 like_PRP artificial_AJ0 intelligence_NN1 (_PUL AI_NN1 )_PUR and_CJC natural_AJ0 language_NN1 processing_NN1 (_PUL NLP_NP0 )_PUR can_VM0 be_VBI used_VVN to_TO0 augment_VVI TPRM_NN1 and_CJC power_NN1 performance_NN1 alongside_PRP human_AJ0 thought_NN1 processes_NN2 and_CJC traditional_AJ0 analytics_NN2 ._SENT In_PRP fact_NN1 ,_PUN risk_NN1 management_NN1 lends_VVZ itself_PNX particularly_AV0 well_AV0 to_PRP these_DT0 capabilities_NN2 ,_PUN as_CJS risk_NN1 issues_NN2 frequently_AV0 include_VVB unlikely_AJ0 and_CJC /_PUN or_CJC ambiguous_AJ0 events_NN2 ._SENT 
Most_AV0 importantly_AV0 ,_PUN risk_NN1 practitioners_NN2 should_VM0 start_VVI to_TO0 think_VVI like_PRP software_NN1 developers_NN2 and_CJC adopt_VVB a_AT0 "_PUQ shift_NN1 left_VVN "_PUQ approach_NN1 to_PRP third-party_AJ0 risk_NN1 management_NN1 ._SENT Shift_NN1 left_NN1 is_VBZ a_AT0 practice_NN1 used_VVN by_PRP developers_NN2 to_TO0 find_VVI and_CJC prevent_VVI defects_NN2 early_AJ0 in_PRP the_AT0 software_NN1 delivery_NN1 process_NN1 ._SENT The_AT0 idea_NN1 is_VBZ to_TO0 improve_VVI quality_NN1 by_PRP addressing_VVG the_AT0 most_AV0 vulnerable_AJ0 tasks_NN2 as_CJS early_AJ0 in_PRP the_AT0 lifecycle_NN1 as_CJS possible_AJ0 ._SENT 
Bringing_VVG Automation_NN1 and_CJC Orchestration_NN1 to_PRP TPRM_NN1 
Many_DT0 organizations_NN2 —_PUN particularly_AV0 financial_AJ0 services_NN2 institutions_NN2 —_PUN manage_VVB their_DPS TPRM_AJ0 programs_NN2 in_PRP silos_NN2 ,_PUN separating_VVG risk_NN1 into_PRP operational_AJ0 units_NN2 ,_PUN which_DTQ are_VBB powered_VVN by_PRP people_NN0 ._SENT The_AT0 TPRM_AJ0 processes_NN2 are_VBB performed_VVN manually_AV0 by_PRP subject_AJ0 matter_NN1 experts_NN2 who_PNQ spend_VVB much_DT0 of_PRF their_DPS time_NN1 on_PRP data_NN0 collection_NN1 and_CJC administration_NN1 ._SENT But_CJC even_AV0 with_PRP highly_AV0 automated_AJ0 systems_NN2 ,_PUN TPRM_NN1 teams_NN2 are_VBB often_AV0 overwhelmed_VVN by_PRP the_AT0 sheer_AJ0 volume_NN1 of_PRF data_NN0 spread_VVN across_PRP many_DT0 sources_NN2 —_PUN from_PRP questionnaires_NN2 and_CJC related_AJ0 documents_NN2 to_PRP external_AJ0 sources_NN2 such_DT0 as_PRP cyber_AJ0 posture_NN1 or_CJC financial_AJ0 stability_NN1 —_PUN and_CJC by_PRP the_AT0 unceasing_AJ0 pace_NN1 of_PRF monitoring_VVG it_PNP ._SENT The_AT0 volume_NN1 of_PRF data_NN0 and_CJC the_AT0 repetitive_AJ0 nature_NN1 of_PRF collecting_VVG and_CJC monitoring_VVG increase_NN1 the_AT0 risk_NN1 of_PRF human_AJ0 error_NN1 ,_PUN such_DT0 as_PRP missing_VVG important_AJ0 details_NN2 or_CJC subtle_AJ0 changes_NN2 that_CJT a_AT0 machine_NN1 learning_NN1 engine_NN1 can_VM0 detect_VVI ._SENT 
Compounding_VVG this_DT0 problem_NN1 is_VBZ the_AT0 fact_NN1 that_CJT critical_AJ0 third-party_AJ0 data_NN0 is_VBZ collected_VVN on_PRP disparate_AJ0 spreadsheets_NN2 located_VVN throughout_PRP the_AT0 organization_NN1 ,_PUN making_VVG it_PNP very_AV0 difficult_AJ0 to_TO0 connect_VVI the_AT0 data_NN0 and_CJC look_VVB across_PRP the_AT0 entire_AJ0 third-party_AJ0 risk_NN1 landscape_NN1 ._SENT 
AI-driven_AJ0 digital_AJ0 TPRM_NN1 technology_NN1 can_VM0 help_VVI by_PRP orchestrating_VVG and_CJC automating_VVG the_AT0 TPRM_AJ0 program_NN1 ,_PUN from_PRP initial_AJ0 assessment_NN1 to_PRP continuous_AJ0 monitoring_NN1 and_CJC mitigation_NN1 ._SENT AI_NN1 is_VBZ uniquely_AV0 able_AJ0 to_TO0 handle_VVI and_CJC evaluate_VVI unstructured_AJ0 data_NN0 ,_PUN enabling_VVG these_DT0 solutions_NN2 to_TO0 extract_VVI data_NN0 from_PRP questionnaires_NN2 ,_PUN evidence_NN1 documents_NN2 ,_PUN financial_AJ0 stability_NN1 sources_NN2 ,_PUN cyber_AJ0 posture_NN1 or_CJC the_AT0 deep_AJ0 web_NN1 and_CJC turn_VVB it_PNP into_PRP actionable_AJ0 insights_NN2 about_PRP a_AT0 bank_NN1 's_POS risk_NN1 exposure_NN1 to_PRP online_AJ0 assets_NN2 ,_PUN fourth_ORD parties_NN2 ,_PUN people_NN0 ,_PUN locations_NN2 and_CJC other_AJ0 vulnerabilities_NN2 ._SENT 
Advanced_AJ0 analytics_NN2 can_VM0 also_AV0 provide_VVI companies_NN2 with_PRP real-time_AJ0 visibility_NN1 into_PRP their_DPS concentration_NN1 risk_NN1 and_CJC the_AT0 domino_NN1 effects_NN2 from_PRP a_AT0 manifestation_NN1 of_PRF an_AT0 event_NN1 ._SENT This_DT0 enables_VVZ risk_NN1 managers_NN2 to_TO0 model_VVI the_AT0 potential_AJ0 cascading_AJ0 effects_NN2 from_PRP a_AT0 risk_NN1 event_NN1 across_PRP their_DPS supply_NN1 chain_NN1 by_PRP letting_VVG them_PNP view_NN1 concentration_NN1 risk_NN1 from_PRP whatever_DTQ aggregator_NN1 they_PNP choose_VVB such_DT0 as_CJS geographic_AJ0 location_NN1 ,_PUN fourth_ORD parties_NN2 or_CJC other_AJ0 vulnerabilities_NN2 ._SENT 
Adopting_VVG a_AT0 New_AJ0 Strategy_NN1 to_PRP Ensure_VVB Resiliency_NN1 
To_TO0 manage_VVI third-party_AJ0 risk_NN1 in_PRP an_AT0 increasingly_AV0 uncertain_AJ0 world_NN1 ,_PUN organizations_NN2 need_VVB their_DPS TPRM_AJ0 programs_NN2 to_PRP "_PUQ shift_NN1 left_VVD ._SENT "_PUQ In_PRP the_AT0 data_NN0 science_NN1 and_CJC intelligence_NN1 worlds_NN2 ,_PUN shift_NN1 left_VVD means_NN0 obtaining_VVG the_AT0 data_NN0 in_PRP the_AT0 rawest_AJS state_NN1 possible_AJ0 ,_PUN before_CJS it_PNP is_VBZ digested_VVN ,_PUN since_CJS digested_AJ0 data_NN0 is_VBZ inherently_AV0 biased_VVN ._SENT The_AT0 same_DT0 holds_VVZ true_AJ0 for_PRP TPRM_NN1 —_PUN risk_NN1 managers_NN2 should_VM0 get_VVI third-party_AJ0 data_NN0 as_CJS raw_AJ0 as_CJS possible_AJ0 ._SENT 
Current_AJ0 methods_NN2 of_PRF data_NN0 collection_NN1 like_PRP questionnaires_NN2 provide_VVB only_AV0 a_AT0 pinhole_NN1 view_NN1 of_PRF a_AT0 third_ORD party_NN1 ,_PUN limited_VVN by_PRP the_AT0 questions_NN2 asked_VVN and_CJC the_AT0 third_ORD party_NN1 's_POS answers_NN2 at_PRP that_DT0 time_NN1 ._SENT A_AT0 better_AJC source_NN1 would_VM0 be_VBI the_AT0 third_ORD party_NN1 's_POS internal_AJ0 documents_NN2 ,_PUN such_DT0 as_PRP business_NN1 continuity_NN1 plans_NN2 (_PUL BCP_NP0 )_PUR and_CJC other_AJ0 operative_AJ0 documents_NN2 that_CJT contain_VVB much_AV0 more_AV0 valuable_AJ0 data_NN0 ._SENT For_PRP example_NN1 ,_PUN a_AT0 questionnaire_NN1 may_VM0 not_XX0 have_VHI asked_VVN the_AT0 third_ORD party_NN1 about_PRP its_DPS readiness_NN1 to_TO0 handle_VVI a_AT0 pandemic_AJ0 like_AJ0 COVID-19_NN1 —_PUN but_CJC the_AT0 company_NN1 's_POS BCP_NP0 probably_AV0 would_VM0 have_VHI contained_VVN relevant_AJ0 details_NN2 ._SENT This_DT0 might_VM0 also_AV0 prove_VVI useful_AJ0 for_PRP the_AT0 third_ORD parties_NN2 ,_PUN since_CJS answering_VVG a_AT0 questionnaire_NN1 takes_VVZ more_DT0 time_NN1 and_CJC effort_NN1 than_CJS providing_VVG an_AT0 existing_AJ0 document_NN1 ._SENT 
As_CJS part_NN1 of_PRF the_AT0 shift_NN1 left_NN1 strategy_NN1 ,_PUN companies_NN2 should_VM0 also_AV0 :_PUN 
Establish_VVB a_AT0 "_PUQ single_AJ0 data_NN0 lake_NN1 "_PUQ to_TO0 enable_VVI the_AT0 massive_AJ0 volume_NN1 of_PRF data_NN0 collected_VVN (_PUL including_PRP real-time_AJ0 streamed_AJ0 data_NN0 )_PUR to_TO0 be_VBI stored_VVN in_PRP and_CJC analyzed_VVN from_PRP a_AT0 single_AJ0 ,_PUN centralized_AJ0 place_NN1 ._SENT When_CJS all_DT0 the_AT0 information_NN1 is_VBZ in_PRP one_CRD place_NN1 ,_PUN it_PNP is_VBZ easier_AJC to_TO0 identify_VVI problems_NN2 ,_PUN connect_VVB the_AT0 dots_NN2 and_CJC understand_VVB how_AVQ everything_PNI is_VBZ related_VVN in_PRP a_AT0 wider_AJC context_NN1 ._SENT 
Adapt_VVB processes_NN2 and_CJC workflows_NN2 to_TO0 handle_VVI new_AJ0 data_NN0 sources_NN2 that_CJT may_VM0 not_XX0 have_VHI been_VBN designed_VVN for_PRP TPRM_NN1 but_CJC should_VM0 be_VBI used_VVN ,_PUN such_DT0 as_PRP severe_AJ0 weather_NN1 alerts_NN2 ,_PUN COVID-19_AJ0 outbreak_NN1 alerts_NN2 ,_PUN cloud_NN1 provider_NN1 health_NN1 dashboards_NN2 and_CJC even_AV0 open-source_AJ0 vulnerability-monitoring_AJ0 solutions_NN2 ._SENT These_DT0 sources_NN2 should_VM0 be_VBI implemented_VVN for_PRP not_XX0 only_AV0 every_AT0 new_AJ0 third_ORD party_NN1 but_CJC also_AV0 for_PRP existing_AJ0 partners_NN2 to_TO0 continuously_AV0 reevaluate_VVI the_AT0 risk_NN1 they_PNP pose_VVB to_PRP the_AT0 organization_NN1 ._SENT 
Accelerate_VVB digitization_NN1 so_AV0 that_CJT the_AT0 overall_AJ0 TPRM_NN1 process_NN1 is_VBZ more_AV0 agile_AJ0 and_CJC able_AJ0 to_TO0 keep_VVI pace_NN1 with_PRP business_NN1 and_CJC global_AJ0 events_NN2 ,_PUN and_CJC to_TO0 respond_VVI faster_AV0 ._SENT Digitizing_VVG the_AT0 TPRM_AJ0 process_NN1 is_VBZ critical_AJ0 ,_PUN as_CJS it_PNP can_VM0 sidestep_VVI slow-moving_AJ0 ,_PUN lengthy_AJ0 administrative_AJ0 policies_NN2 as_CJS well_AV0 as_CJS labor-intensive_AJ0 processes_NN2 ,_PUN thereby_AV0 making_VVG transformations_NN2 less_AV0 cumbersome_AJ0 and_CJC more_AV0 agile_AJ0 ._SENT Digitization_NN1 is_VBZ key_AJ0 for_PRP continuous_AJ0 monitoring_NN1 to_TO0 keep_VVI up_AVP with_PRP the_AT0 ever-changing_AJ0 risks_NN2 third_ORD parties_NN2 pose_VVB ._SENT Digitization_NN1 also_AV0 frees_VVZ TPRM_AJ0 experts_NN2 from_PRP having_VHG to_TO0 administer_VVI data_NN0 from_PRP many_DT0 sources_NN2 ,_PUN allowing_VVG them_PNP to_TO0 build_VVI mitigation_NN1 plans_NN2 more_AV0 effectively_AV0 ._SENT 
A_AT0 year_NN1 full_AJ0 of_PRF black_AJ0 swan_NN1 events_NN2 like_PRP 2020_CRD has_VHZ shown_VVN us_PNP that_DT0 current_AJ0 TPRM_NN1 practices_NN2 are_VBB not_XX0 enough_AV0 to_TO0 handle_VVI today_AV0 's_POS challenges_NN2 ._SENT Companies_NN2 need_VVB to_TO0 shift_VVI left_VVN to_PRP a_AT0 more_AV0 intelligent_AJ0 ,_PUN automated_AJ0 approach_NN1 to_PRP TPRM_NN1 to_TO0 ensure_VVI continued_AJ0 resiliency_NN1 and_CJC growth_NN1 ._SENT 
