Joint ESA report also highlights the role of third parties as incident originators and warns about impending risk from AI.
Third-party risk management
Regulation to push European businesses and third-country suppliers to consider potential exposure to government influence when assessing their technology vendor relationships.
New regime changes how firms report serious incidents and critical third-party dependencies, gives regulators improved real-time visibility of threats.
CIRO offers guidance on how to notify the agency about third-party risk management control providers and when agreements with them are terminated.
The practical reality of AI-augmented threats, who should be responsible for governance, and how to deal with the pitfalls of vendor management.
Regulator says new rules will make existing incident and third-party reporting clearer, more consistent, and easier for firms to follow.
The amendments significantly expand expectations around incident response, customer notification, and service provider oversight.
Janaya Moscony and Leigh Wittick spoke to GRIP about how financial institutions can demonstrate compliance with the many components of Reg S-P.