CyberGRX > Case Studies > Scaling Third-Party Cyber Risk Management Post-Merger with CyberGRX

Scaling Third-Party Cyber Risk Management Post-Merger with CyberGRX

Applicable Industries

National Security & Defense

Applicable Functions

Human Resources

Use Cases

Tamper Detection

Services

System Integration

The Customer

Not disclosed

About The Customer

The customer in this case study is a technology company that had recently undergone a merger with another organization. This merger resulted in a significant expansion of their third-party ecosystem, doubling the number of third parties they had to manage. Prior to the merger, the company had an efficient system for managing their third-party ecosystem, which included an in-house assessment working in tandem with a GRC tool. However, the merger put a strain on this system, and the company found themselves unable to scale their current program to effectively manage their new vendors without an increase in human resources.

The Challenge

A technology company faced a significant challenge after merging with another organization, which resulted in the doubling of their third-party ecosystem. Prior to the merger, the company had an efficient third-party program that included an in-house assessment working in tandem with a GRC tool. However, the merger put a strain on this system as the number of third parties in their ecosystem doubled. The company's team was unable to scale their current program to effectively manage their new vendors due to a lack of increase in human resources. The company was in need of a solution that could seamlessly integrate with and scale their process, enabling them to apply the right level of due diligence across their new and expanded ecosystem efficiently.

The Solution

The technology company partnered with CyberGRX to address their challenge. CyberGRX worked closely with the company to ensure that their solution was integrated seamlessly into the company's process, enabling it to quickly scale to accommodate their needs. The CyberGRX assessment mapped closely to the company’s key security controls, and the CyberGRX Exchange facilitated the execution of the assessment process across the expanded ecosystem. Several of the company’s third parties had already completed an assessment on the CyberGRX Exchange, which saved the company time and effort in assessing them. For any assessment that wasn’t already on the Exchange, CyberGRX managed the requests as an end-to-end service. As the assessment results were returned, CyberGRX facilitated the remediation requests between the technology company and their vendors. The ability for third-parties to renew their assessments or make updates on the Exchange eliminated the need for the company to re-assess third parties annually.

Operational Impact

The implementation of the CyberGRX solution allowed the technology company to refocus their internal team's efforts on vendor discovery and other internal processes. Through the CyberGRX assessments, the company was able to identify several vendors whose current security posture posed too great a risk to their organization. This enabled them to make informed business decisions about whether and how to work with those vendors in the future. The seamless integration of the CyberGRX solution into their process also ensured that the company could efficiently manage their expanded third-party ecosystem.

Quantitative Benefit

The company was able to conduct 30 CyberGRX assessments.
The company saved significant time and effort by using the CyberGRX Exchange, where several of their third parties had already completed assessments.
The company eliminated the need to re-assess third parties annually, thanks to the ability for third-parties to renew their assessments or make updates on the Exchange.