0
02

Due diligence with third parties

In this topic, you’ll learn how CBA’s suppliers also need to be operating within the same guardrails. You’ll also hear about some case studies where information security was compromised.

Scroll down
to learn more

Doug’s dilemma

Doug’s starting to get across his service and is working on a project that will require the engagement of an external supplier. He’s very experienced in working with third party providers, and is adhering to CBA’s sourcing and supplier governance frameworks as he commences the project. However, as Doug knows that his supplier will be required to handle our Group and customer information, he wants to know how he can better understand their security controls.

We’re a large organisation. We engage many suppliers as part of our regular business operations to assist with the provision of:

  • Infrastructure
  • Telecommunications
  • Applications
  • Other services

This means that there are many suppliers in our ecosystem that are required to handle our Group and customer information.

Suppliers are attractive targets for malicious cyber attacks as their security defenses are often perceived to be weaker and therefore a potential gateway to valuable information.

Click play to learn about a data breach impacting US company Target.

In December 2013, hackers were able to get access to US company Target’s network through a third-party supplier, resulting in the breach of the personal details of over 70 million customers.

This led to enormous reparations, loss of jobs, loss of reputation and 140 lawsuits against Target alone.

Doug understands that it’s essential that our Group and customer information is protected. Any supplier accessing our information must have robust controls for protecting it.

It is essential that everyone at CBA conducts due diligence on suppliers, both before and during onboarding, and then on an ongoing basis.

Doug’s accountabilities

As a Service Owner, Doug is required to undertake a number of due diligence activities when engaging third party suppliers, as per the:

  • Supplier Governance Framework
  • Sourcing Process
  • Supplier Risk Management, Outsourcing and Offshoring Policy and Standards

Examples of some of these responsibilities include:

  • Ensuring that security is considered right from the start of a supplier engagement
  • Completing all applicable risk assessments (e.g. Privacy Impact Assessment, Supplier Security Assessment, Technology Risk Assessment, etc.)
  • Maintaining situational awareness and being alert to data breaches or changes impacting his suppliers, and notifying DPG and his Line 1 Risk team of these as appropriate
  • Enforcing conditions as per commercial contracts
  • Calling-out and raising issues of non-compliance

Best practice

Doug needs to engage a new third party to make bank cards for CBA. However, there are some aspects of the Information Security Policy and Standards that he does not know how to ensure a vendor can comply with.

What should his next steps be?

Doug’s pretty sure that he’s doing the right thing following the Sourcing Process, so takes his RFP to market. Through that process, a vendor is selected. However, as the onboarding process progresses and Doug starts to complete his risk assessments, a number of Information Security Policy and Standards non-compliance issues are discovered.

If Doug had engaged DPG for additional clarity on the Information Security Policy and Standards before issuing the RFP, he could have improved coverage of security considerations, which would have led to better and safer business outcomes.

Doug’s glad he contacted Jamie when he did. Even though he was adhering to CBA’s supplier governance policies and frameworks and was aware of some security considerations to include in the RFP, Jamie gave him some additional suggestions. This helped him assess the suppliers’ ability to comply with the Information Security Policy and Standards before a vendor was selected, and collect the right information to complete his risk assessments.

Best practice

Doug hears from a colleague at CBA that one of his suppliers are moving the location of their data centres, from one country to another. What should he do?

What should he do?

In the meantime, there is an issue of compliance with this supplier. Doug learns the importance of actioning this information immediately. Jamie explains to him the importance of maintaining situational awareness to ensure good supplier governance at all times.

Yes, that is correct. Once you have confirmed this information with your supplier, engage DPG, Line 1 Risk and Enterprise Procurement and Partnerships (EPP) to ascertain if a risk assessment needs to be revised or updated. Jamie explains to Doug the importance of maintaining situational awareness to ensure good supplier governance at all times.

Jamie’s tips

Let’s revisit the key steps in exercising due diligence on third parties when it comes to protecting our information.

As you click each one, consider how that affects you in your day-to-day work.

Back at work

The current version of all supporting documents are available on the Intranet.

Doug should always use the latest published documents to help ensure suppliers are compliant. If he has any concerns, people like Jamie in DPG are only a phone call or email away.

Information Security Policy

Information Security Standards

Engaging DPG for help

Supplier Governance, Sourcing and Risk Management Policy and Standards

Supplier Governance Process

Sourcing Process

Risk Management, Outsourcing and Offshoring Policies and Standards

Enterprise Supplier Risk

Congratulations, you've finished Topic 2

Select the buttons below to continue.