ADGM FSRA Information Technology Risk Management Guidance (VER01.201124) 3.3: Understand and diversify the supply chain behind material third parties and oversee onward data sharing

What does 3.3 require?

An institution relying on third parties for material activities understands those third parties' supply chains so they can anticipate risk events such as hardware shortages, shipping delays or disruption of major internet and telecommunications providers and act pre-emptively; where appropriate and possible they diversify third parties to improve supply chain resilience; and they keep oversight of how third parties pass their data on to, or open it up to, other parties, in line with regulatory obligations.