Cybersecurity and Third-Party Risk

Chapter 14Offshore Third‐Party Cybersecurity Risk

Offshore vendors pose a different risk than those who reside within your home country. The majority of the time, the term offshore refers to those who are located in countries where business process outsourcing is typical; for example, India, the Philippines, Vietnam, South America, and others outside the United States, Canada, Europe, and other countries where costs can be higher than for the same processes outsourced to a lower‐cost location. Challenges exist in performing both due diligence and due care for the location, and differences in standards, practices, regulations, culture, and other risks offshore exist in comparison to a supplier local to your shores.

Distance can present challenges for several reasons. Vendors and their subject‐matter experts (SMEs) who participate in the conversations for due diligence are remote, and can be located in different time zones, making scheduling a challenge. Typically, this can be overcome by including a local representative from the offshore vendor, and/or when the remote staff is on your local time or have an agreed schedule that overlaps with the home country's time zones. There can also be issues with holiday coverage and notification risks. Secondly, the third‐party's distance makes performing on‐site due diligence costly in terms of time and travel. Some countries might require a visa for entry and can take a day of travel, depending on locations and connecting flights.

Local ...