Contractual Agreement Aspect of Third-party Risk Management in Information Security
DOI:
https://doi.org/10.46243/jst.2025.v10.i07.pp01-09Keywords:
Contracts, Contractual Agreement,, Information Security,, Third-Party Risk Management, Vendor.Abstract
Third-party risks are those faced by an organization when incorporating external entities into
their ecosystem, infrastructure, or supply chains. These external parties may take the form of
vendors, suppliers, partners, contractors, or service providers, all of whom are granted access to
internal data concerning systems, processes, intellectual property, customer information, or
internal communication. Organizations are reliant on outsourcing, subcontracting, and offshoring
to support their business, this has amplified the need for effective Third-Party Risk Management
(TPRM) frameworks. Although these practices offer operational efficiency, they introduce
inherent risks, necessitating a careful approach to information security (IS). This article explores
the pivotal role of contractual agreements in TPRM, addressing key questions about contract
deficiencies, adaptability to evolving risks, regulatory impacts, and strategies for incentivizing
third-party risk management. Thorough due diligence, collaborative approaches, and
supplementary risk management strategies have been emphasized in the existing literature. The
conceptual framework underscores the detrimental impact of weak contracts, advocating
dynamic risk assessments, adaptable security standards, and communication and collaboration
channels. Addressing variations in laws and regulations is crucial and requires a clear contractual
provisions and language. The study concludes by providing insights into incentivizing third
parties to adapt risk management practices and off-the-shelf tools and services handling, thereby
contributing a comprehensive guide for organizations to manage third-party relationships in the
domain of information security.
References
Aris, S. R. H. S., Arshad, N. H., & Mohamed, A. (2008). Conceptual framework on risk management in IT outsourcing projects. management, 36(37), 37-38
Bhatti, B. M., Mubarak, S., & Nagalingam, S. (2021). Information security risk management in it outsourcing–a quarter-century systematic literature review. Journal of Global Information Technology Management, 24(4), 259-298
Boggavarapu, S. (2021). The Effect of Third-Party Service Providers on Information Security Breaches at Financial Institutions (Doctoral dissertation, University of the Cumberlands)
Bomhard, D., & Daum, A. (2021). Cybersecurity in outsourcing and cloud computing: a growing challenge for contract drafting, International Cybersecurity Law Review, 2(1), 161-171
Haller, J., & Wallen, C. (2016). Managing Third Party Risk in Financial Services Organizations: A Resilience-Based Approach, Carnegie Mellon University Software Engineering Institute. Ayoub Alfawzan, Omer Alrwais: Contractual Agreement Aspect of Third-party Risk Management in Information Security
Singh, A. (2009). Improving Information Security Risk Management [Unpublished doctoral dissertation]. University of Minnesota
VanHoy, J. (2021). Third Party Risk Management. Available at SSRN 3763399
