Chapter 4.8 · Third-party risk¶
The core EBIOS cycle (Workshops 1 to 5) is now complete. The last two chapters are specialised applications of the same method, not new methods. Third-party risk deepens the ecosystem view that Workshop 3 opened: the suppliers whose weaknesses became Scaldimet's worst attack paths.
Two Lessons, one on each side of a relationship Scaldimet sits in the middle of. The first is third-party risk management looking outward: assessing the suppliers whose weaknesses became Scaldimet's worst attack paths. The second flips the view: Scaldimet is itself a critical supplier to the OEM, so it must answer the same assessments it sends. The dual perspective is the point.
Objectives¶
- Assess and tier your own suppliers, and put security obligations into contracts and monitoring.
- Respond effectively when a customer assesses you as a critical supplier.
- See why the two perspectives are the same discipline viewed from opposite ends.
Lessons¶
| Lesson | Title | Time |
|---|---|---|
| 4.8.A | Assessing your suppliers | ~45 min |
| 4.8.B | Being assessed as a critical supplier | ~45 min |
The Chapter quiz is at the end of Lesson 4.8.B.