Latest Articles

Your Contracts Are Your First Line of Defense — Embed Risk Clauses Before You Need Them The Contract as a Risk Management Tool Contracts are the final and critical piece of vendor risk management . Well-drafted contracts not only facilitate effective cost management but also ensure continuity when unexpected changes occur in the world . Essential Contractual Clauses 1. Data Management and Access Guarantee access to your data in usable formats  Include provisions for real-time backups  Data escrow clause for critical data and applications  Data deletion upon contract termination  2. Service Continuity Transition assistance or unwind clauses  Clear and time-bound exit strategy  Vendor requirement for data migration  Guarantees of data delivery in an open, non-proprietary format  3. Compliance and Transparency Clear assurances and contractual clauses on regulatory compliance  Immediate notification of changes in compliance status  Strong right to audit in all contracts  Complete transparency from the vendor  4. Suspension and Termination Options to pause services or promptly terminate if vendor is sanctioned  Specific and restricted conditions under which vendor can suspend services  Process for service restoration  5. Force Majeure Very strong force majeure clause to include geopolitical aspects  Data access, suspension triggers and emergency continuity clauses  6. Incident Reporting How and when vendors should report security breaches or compliance lapses  Protocols should tie incidents based on their impact on the firm  Roles and responsibilities for remediation and escalations  Geopolitical Considerations When entering new vendor contracts or revisiting older ones, CIOs must start with getting the basics right : Screen vendors and their parent companies for sanctions Evaluate connections with sensitive regions Assess geopolitical exposure of technology partners  Sanctions awareness: A vendor's failure to maintain compliance or their appearance on a sanctions list should trigger a formal review or even a potential contract termination . The "Right to Audit" Clause Strengthen onboarding of new vendor processes to include sanctions, ownership structures and also ensuring strong right to audit in all contracts . What to look for: Right to conduct security assessments Right to review audit and assessment reports  Right to conduct on-site assessments, if required  Adaptive Compliance Clauses Embed compliance obligations within contracts and ensure they are adaptive compliance clauses that automatically update to reflect changes in financial regulation, ensuring continuous compliance without manual contract revisions . Example: A financial services firm could include a clause stating that the vendor must comply with all current and future regulations related to data protection and privacy, as applicable under federal and state laws . Negotiation Leverage In some industries, such as financial services, critical infrastructure and healthcare, regulatory obligations can be used as a negotiation lever . In other organizations, this should be a board-level priority as it potentially impacts business continuity in a material way . Conclusion Contracts are the final and critical piece of vendor risk management . Organizations that embed risk management in vendor contracts—with data access, suspension triggers, and emergency continuity clauses—will cushion the impact of geopolitical and operational risks . Action Items for Your Organization Review all critical vendor contracts Embed data management and access clauses Include compliance and transparency requirements Add suspension and termination provisions Strengthen right to audit clauses Review indemnification clauses  

The EU AI Act, California AI Act, and 56 Other Laws — Why AI Incident Response Is No Longer Optional The Regulatory Tsunami AI incident response is no longer a "nice-to-have." It's a regulatory requirement. The OECD recorded 596 AI incidents in January 2026 alone —a 200% increase year-over-year. Organizations now face regulatory requirements across 56 binding laws and 47 frameworks globally . The regulatory landscape includes: Regulation Scope Key Requirements EU AI Act Any AI used in EU Risk classification, compliance requirements, incident reporting California AI Act AI used in California Transparency, accountability, incident reporting State-level AI laws Various US states Disclosure requirements, consumer protections NYC AI Law New York City Bias testing, disclosure requirements Regulatory guidance Multiple jurisdictions Incident reporting, governance requirements The EU AI Act: A New Standard The EU AI Act, which became effective in 2024, is the most comprehensive AI regulation globally. It establishes: Risk Classifications Risk Level Examples Requirements Unacceptable Social scoring, subliminal manipulation Prohibited High-risk Critical infrastructure, education, employment Compliance, conformity assessment, incident reporting Limited risk Chatbots, AI assistants Transparency obligations Minimal risk AI games, spam filters No requirements Incident Reporting Requirements High-risk AI systems must report: Serious incidents (health, safety, fundamental rights impact) Malfunctions (deviations from intended use) Cybersecurity vulnerabilities Reporting timelines: 15 days for serious incidents. Governance Requirements High-risk AI systems must: Establish risk management processes Maintain documentation and logging Ensure transparency and explainability Enable human oversight Maintain accuracy and robustness Implement cybersecurity protections The AI Incident Response Requirements Across regulatory frameworks, organizations need: 1. Detection Capabilities Monitor AI behavior Detect AI incidents when they occur Distinguish AI incidents from traditional incidents 2. Investigation Capabilities Investigate AI behavior and root causes Document AI incident findings Track AI incident resolution 3. Reporting Capabilities Report AI incidents to regulators Report AI incidents to affected users Manage AI incident communications 4. Remediation Capabilities Contain AI incidents to prevent further harm Fix the underlying issues Implement preventive controls 5. Record-Keeping Capabilities Maintain AI incident logs Document investigations and resolutions Demonstrate compliance to regulators The CYGNVS Model for AI Incident Response The CYGNVS model provides a framework for AI incident response that's emerged from the cybersecurity field. CYGNVS Model (Isolated Incident Response) Step Description Identify Detect that an AI incident is occurring Isolate Contain the incident to prevent further damage Investigate Understand what happened and why Resolve Fix the incident and restore normal operations Learn Implement preventive measures Report Communicate to stakeholders and regulators Building AI Incident Response Capabilities 1. Update Incident Response Playbooks Add AI-specific incident categories, response steps, and roles. Ensure your teams know what to do when an AI incident occurs. 2. Create AI Incident Response Roles Role Responsibility AI Incident Commander Coordinates the response AI Investigator Investigates AI behavior and root causes AI Compliance Lead Assesses regulatory implications AI Communications Lead Manages communications 3. Implement AI Detection Capabilities Capability Description AI behavior monitoring Track what AI agents are doing Access monitoring Monitor AI access to data and systems Output monitoring Detect AI outputs that may indicate incidents Anomaly detection Identify unusual AI behavior patterns 4. Build AI Reporting Capabilities Regulatory reporting templates for AI incidents User notification templates Internal communication protocols 5. Establish AI Governance AI risk assessment processes AI compliance monitoring AI incident tracking and reporting The Role of AI in AI Incident Response Ironically, AI can help respond to AI incidents. AI capabilities for incident response include: Automated detection: Identify AI incidents when they occur Root cause analysis: Understand why AI incidents happened Pattern recognition: Identify AI incident patterns Recommendation generation: Suggest remediation steps Regulatory reporting: Generate incident reports Conclusion: AI Incident Response Is Now Mandatory AI incident response is no longer optional. Regulatory requirements demand it. Operational risks demand it. Stakeholder expectations demand it. Organizations that build AI incident response capabilities—detection, investigation, reporting, remediation, and record-keeping—will be ready for AI incidents and regulatory scrutiny. Those that don't will face regulatory penalties, operational consequences, and reputational damage. AI incident response isn't just good practice. It's the law. Action Items for Your Organization Understand your regulatory obligations: Map which AI regulations apply to your organization Update incident response playbooks: Add AI-specific incident categories and response steps Build AI detection capabilities: Implement monitoring, logging, and anomaly detection Create AI reporting capabilities: Prepare for regulatory reporting requirements Establish AI governance: Implement risk assessment, compliance monitoring, and incident tracking Train teams: Ensure teams understand AI incident response requirements  

Geopolitical Risk Is No Longer a Checkbox — It's a Central Driver of Vendor Decisions The New Risk Reality Geopolitical risk has largely been a check box item in organizations' IT risk management documents, until now . As geopolitical tensions hit an all-time high with the tariff wars as well as the ongoing Russia-Ukraine and Israel-Palestine conflicts, the theoretical frameworks are now being widely tested in the real world . The Microsoft Suspension: A Warning Trigger No risk management framework and business continuity plan would have prepared Nayara Energy (an oil refinery company backed by Russia's Rosneft) for the sudden suspension of Microsoft's cloud services following the EU sanctions on Russia. This one incident might be an exception pointing to one extreme, but nevertheless a warning trigger . Why Geopolitical Risk Matters Sanctions and Trade Restrictions Sanctions, tariff wars and trade restrictions are impacting nearly all geographies . These risks will increasingly wield stronger influence on CIOs' decisions around how they assess their vendors, draw up contracts and conduct audits . Hidden Risks A company may appear operating solely within one jurisdiction but might have a parent company or key investors subjected to regulations from a different country . Service Suspension Bans on technology companies serve as clear examples of services being abruptly restricted due to regulatory actions . Integrating Geopolitical Risk into VRM Vendor Assessment : Evaluate geopolitical exposure of technology partners  Screen vendors and their parent companies for sanctions  Evaluate connections with sensitive regions  Assess vulnerability to sanctions  Evaluate dependencies on other potentially high-risk third parties  Continuous Monitoring : Stay informed of evolving global regulations  Use threat intelligence feeds and news monitoring  Use specialized risk assessment platforms for real-time alerts  Monitor sanctions lists and political risk indices  Contractual Protection : Stronger vendor contracts covering data access, suspension triggers and emergency continuity  Very strong force majeure clause to include geopolitical aspects  Options to pause services or promptly terminate if vendor is sanctioned  Vendor Diversification : Avoid over-reliance on a single vendor from sensitive regions  Enlist alternative vendors for critical services  Identify plan B vendors upfront  The Strategic Shift "Vendor risk can no longer be assessed solely from a technical or procurement perspective. Geopolitics must be a central consideration in organizations' digital infrastructure decisions" . Proactive Strategies Vendor Diversification: Avoiding over-reliance on a single vendor from sensitive regions helps ensure operational resilience . Plan B Vendors: "For critical services, identify a plan B upfront. This could be a different vendor or an internal capability. If geopolitical risks are elevated and have the potential to impact your suppliers, proactively engage with your identified plan B vendors" . Collaboration: Collaborate with legal, policy, risk and procurement teams to co-own vendor onboarding and risk mapping . Conclusion Geopolitical risk is no longer a peripheral issue for CIOs. Organizations must integrate geopolitical risk into assessments, contracts and monitoring to ensure business continuity . Action Items for Your Organization Integrate geopolitical risk into vendor assessments Screen vendors and parent companies for sanctions Review and strengthen vendor contracts Diversify critical vendors Identify plan B vendors Monitor geopolitical developments continuously Geopolitical Risk Is No Longer a Checkbox — It's a Central Driver of Vendor Decisions The New Risk Reality Geopolitical risk has largely been a check box item in organizations' IT risk management documents, until now . As geopolitical tensions hit an all-time high with the tariff wars as well as the ongoing Russia-Ukraine and Israel-Palestine conflicts, the theoretical frameworks are now being widely tested in the real world . The Microsoft Suspension: A Warning Trigger No risk management framework and business continuity plan would have prepared Nayara Energy (an oil refinery company backed by Russia's Rosneft) for the sudden suspension of Microsoft's cloud services following the EU sanctions on Russia. This one incident might be an exception pointing to one extreme, but nevertheless a warning trigger . Why Geopolitical Risk Matters Sanctions and Trade Restrictions Sanctions, tariff wars and trade restrictions are impacting nearly all geographies . These risks will increasingly wield stronger influence on CIOs' decisions around how they assess their vendors, draw up contracts and conduct audits . Hidden Risks A company may appear operating solely within one jurisdiction but might have a parent company or key investors subjected to regulations from a different country . Service Suspension Bans on technology companies serve as clear examples of services being abruptly restricted due to regulatory actions . Integrating Geopolitical Risk into VRM Vendor Assessment : Evaluate geopolitical exposure of technology partners  Screen vendors and their parent companies for sanctions  Evaluate connections with sensitive regions  Assess vulnerability to sanctions  Evaluate dependencies on other potentially high-risk third parties  Continuous Monitoring : Stay informed of evolving global regulations  Use threat intelligence feeds and news monitoring  Use specialized risk assessment platforms for real-time alerts  Monitor sanctions lists and political risk indices  Contractual Protection : Stronger vendor contracts covering data access, suspension triggers and emergency continuity  Very strong force majeure clause to include geopolitical aspects  Options to pause services or promptly terminate if vendor is sanctioned  Vendor Diversification : Avoid over-reliance on a single vendor from sensitive regions  Enlist alternative vendors for critical services  Identify plan B vendors upfront  The Strategic Shift "Vendor risk can no longer be assessed solely from a technical or procurement perspective. Geopolitics must be a central consideration in organizations' digital infrastructure decisions" . Proactive Strategies Vendor Diversification: Avoiding over-reliance on a single vendor from sensitive regions helps ensure operational resilience . Plan B Vendors: "For critical services, identify a plan B upfront. This could be a different vendor or an internal capability. If geopolitical risks are elevated and have the potential to impact your suppliers, proactively engage with your identified plan B vendors" . Collaboration: Collaborate with legal, policy, risk and procurement teams to co-own vendor onboarding and risk mapping . Conclusion Geopolitical risk is no longer a peripheral issue for CIOs. Organizations must integrate geopolitical risk into assessments, contracts and monitoring to ensure business continuity . Action Items for Your Organization Integrate geopolitical risk into vendor assessments Screen vendors and parent companies for sanctions Review and strengthen vendor contracts Diversify critical vendors Identify plan B vendors Monitor geopolitical developments continuously  

Sanctions Screening Is No Longer Optional — It's a Critical VRM Requirement The Sanctions Reality Sanctions, tariff wars and trade restrictions are impacting nearly all geographies . New vendor onboarding processes should include due diligence around sanctions and ownership structures . Why Sanctions Screening Matters Regulatory Compliance Non-compliance with sanctions can result in significant penalties, legal action, and reputational damage. Business Continuity A vendor that becomes sanctioned may have services abruptly restricted. The Microsoft suspension following EU sanctions on Russia serves as a clear example . Hidden Risks A company may appear operating solely within one jurisdiction but might have a parent company or key investors subjected to regulations from a different country . Key Screening Areas 1. Sanctions Lists Screen vendors and their parent companies against sanctions lists . This includes: UN sanctions lists US OFAC sanctions lists EU sanctions lists Other national sanctions lists 2. Ownership Structures Evaluate ownership structures to identify hidden risks . Who owns the vendor? Who are the key investors? What jurisdictions are they subject to? 3. Connections with Sensitive Regions Evaluate connections with sensitive regions . Does the vendor operate in high-risk regions? Does the vendor have dependencies on high-risk third parties? Integrating Sanctions Screening into VRM Pre-Onboarding : Screen vendors before engagement Evaluate sanctions exposure Assess ownership structures Identify hidden risks Ongoing Monitoring : Monitor sanctions lists continuously Screen for changes in ownership or structure Stay informed of evolving regulations  Contractual Protection : Include sanctions compliance clauses Define suspension or termination triggers  Require immediate notification of compliance changes  The Regulatory Environment Government agencies have begun actively offboarding contractors who fail to meet strict cybersecurity mandates or cannot guarantee that controlled unclassified information is housed in authorized environments . Conclusion Sanctions screening is no longer optional—it's a critical VRM requirement. Organizations that integrate sanctions screening into vendor onboarding and ongoing monitoring will protect themselves from regulatory penalties and operational disruptions. Action Items for Your Organization Integrate sanctions screening into vendor onboarding Screen vendors and parent companies against sanctions lists Evaluate ownership structures and hidden risks Monitor sanctions lists continuously Include sanctions clauses in vendor contracts  

VRM Isn't Just About Compliance — It's a Strategic Advantage That Protects Your Business Beyond Check-the-Box Compliance Vendor risk management is often seen as a compliance exercise—a necessary burden to satisfy auditors and regulators. But effective VRM delivers benefits far beyond check-the-box compliance . 1. Data Breach Defense The Benefit: Without proper VRM policies in place, third-party services are more susceptible to data breaches. VRM details third-party risk exposure, mitigating data breach risk . The Impact: Third-party data breaches can expose sensitive customer data, leading to regulatory penalties and loss of reputation . Real-world example: The MoveIt breach of 2023, where threat actors exploited vulnerabilities in file transfer software to exfiltrate high-value data from approximately 2,300 entities, cost more than $10 billion . 2. Business Continuity The Benefit: VRM evaluates operational resilience of critical business processes, which supports business continuity . The Impact: Supplier-related failures, such as delivery delays or data breaches, can halt business processes, eroding financial and reputational capital . Real-world example: The September 2025 Jaguar Land Rover attack halted production for five weeks, triggering supply chain disruptions with economic losses amounting to nearly £1.9 billion . 3. Supply Chain Visibility The Benefit: VRM identifies not just third-party risks but also fourth-party risks—vendors' vendors—providing visibility into an organization's extended supply chain . The Impact: When you can't see the risk, you can't manage it. VRM illuminates the hidden risks in your supply chain . 4. Regulatory Compliance The Benefit: Understanding and managing third-party risk is part of numerous regulations, including SOX, PCI DSS, and HIPAA . The Impact: Non-compliance with regulations such as GDPR, HIPAA, or PCI DSS leads to significant fines and legal actions . The law clearly states the organization is responsible if a vendor loses personally identifiable information . 5. Business Reputation The Benefit: Third-party vendors negatively affect an organization's reputation through poor security practices, mishandling of sensitive data or failing to meet service standards. VRM pinpoints vendors with possible reputational risks before incidents occur . The Impact: Any vendor security breach that exposes customer data often causes lasting reputational damage to an associated organization, even if the fault lies entirely with the vendor . 6. Clear Accountability The Benefit: VRM ensures that accountability for both the company and the vendor is clearly understood, minimizing confusion about responsibilities when issues arise . The Impact: Without clear accountability, incident response devolves into finger-pointing, delaying resolution and increasing damage. 7. Supplier Quality The Benefit: Regular assessments and continuous monitoring aid vendors in maintaining high standards throughout the relationship, improving everyone's service quality . The Impact: VRM creates a virtuous cycle where vendors improve their practices to maintain the relationship. The Strategic Advantage When TPRM connects to loss exposure, mitigation cost, and operational impact, it stops being compliance theater and becomes a decision system . Organizations that treat VRM as a strategic capability can: Make faster, better-informed vendor decisions Allocate resources to the highest risks Respond more quickly to emerging threats Build stronger vendor relationships based on transparency and trust  Conclusion VRM is not just about compliance—it's a strategic advantage. Organizations that manage third-party risk effectively protect their data, reputation, and operations while building stronger vendor relationships . Action Items for Your Organization Document the business benefits of VRM Communicate VRM value to stakeholders Use VRM insights for strategic decision-making Build vendor relationships based on transparency Measure VRM impact on breach prevention and business continuity  

The Vendor Risk Assessment — A Step-by-Step Guide to Evaluating Third-Party Risk What Is a Vendor Risk Assessment? A vendor risk assessment reviews the vendor to determine how well equipped it is to provide the needed assurance of maintaining information security throughout the data life cycle and/or contractual period . It should identify any potential threats and vulnerabilities that the vendor might encounter and evaluate how well equipped the vendor is to proactively identify and mitigate risk if it materializes . The Assessment Process Step 1: Assemble Internal Stakeholders Gather a cross-functional team representing multiple roles with different priorities : IT Security Compliance Procurement Legal Business owners Step 2: Define Acceptable Risk Levels Before assessing potential vendors, define the organization's risk appetite . This makes the vendor selection process more efficient, identifying vendors that won't meet the required risk tolerance . Step 3: Categorize Vendors by Risk Classify partners into risk levels—critical, moderate, and low—based on service dependency : Critical: Access to sensitive data, business-critical services Moderate: Limited access, moderate impact Low: Minimal access, low impact Step 4: Send Risk Assessment Questionnaires Different types of questionnaires can be sent: Industry-standard questionnaires (SIG, CAIQ, VSAQ)  Customized questionnaires based on organizational needs  Use frameworks such as NIST Cybersecurity Framework when designing questionnaires  Questionnaire focus areas: What security controls do you have in place?  How do you store or process sensitive data?  What is your authentication policy? Is MFA mandatory?  How often do you conduct backups?  Do you have an incident response plan?  What is your privacy policy?  Step 5: Evaluate Assessment Results Review vendor responses Validate claims with evidence Identify gaps and risks Document findings Step 6: Categorize and Remediate Risks Risks identified must be categorized as either acceptable or unacceptable . For unacceptable risks, organizations work with vendors on remediation or terminate the relationship . The FAIR Evaluation Criteria Organizations should consider 4 objectives to be non-negotiable when outsourcing deliverables to a vendor : Restricting Sensitive Data Access: Assessing the effectiveness of the vendor's security measures against unauthorized access, loss, or theft  Ensuring Regulatory Compliance: Vendor risk assessments help ensure that third-party vendors comply with regulations, reducing the risk of legal penalties  Mitigating Supply Chain Risk: A security breach of a vendor can create a domino effect, compromising the entire supply chain  Maintaining Effective Communication: Establishing and maintaining effective communication with vendors on an ongoing basis is critical  Due Diligence Questions Before engaging a vendor, organizations should consider : Have the vendor's security policies, procedures, and practices been vetted and approved by organizational security leaders? Does the vendor follow any industry-recognized best practices or have security certifications? Have audit and assessment reports been reviewed and on-site assessments conducted, if required? Has guidance been sought where required to assess the vendor's security practices? Conclusion Vendor risk assessments are essential for evaluating how well vendors handle secure information throughout the data life cycle . Effective assessments enhance transparency, accountability, and security controls in an evolving cyberrisk environment . Action Items for Your Organization Define vendor risk assessment process Create assessment questionnaires Establish vendor tiering Conduct initial assessments for critical vendors Document findings and remediation plans