US Interagency Sound Practices to Strengthen Operational Resilience A-TPRM: Cyber third-party risk management: risks and control effectiveness managed whether performed internally or by a third party, due diligence and monitoring including testing or auditing of third-party security controls, contracts defining responsibility for access rights, configuration and deployment, verification of resilient third-party processes, and validation that third-party systems will operate or recover within tolerance

What does A-TPRM require?

Cyber third-party practices: the firm manages the risks to its core business lines and critical operations and watches the effectiveness of the related controls whether it does the work itself or a third party does it; planning and due diligence identify third-party risks, and processes measure, monitor and control them, which may include testing or auditing security controls with the third party; contracts say clearly which party configures and manages system access rights, configuration capabilities and the deployment of services and information assets; third-party relationships carry sound risk management to identify and reduce hazards, with controls confirming that the third party runs resilient operational processes in line with the firm's own standards; and processes confirm that third-party systems used for critical operations will keep working during a disruption or come back within the firm's tolerance for disruption.