Please enable JavaScript.
Coggle requires JavaScript to display documents.
🤝 4️⃣ NCA ECC DOMAIN 4 — THIRD-PARTY CYBERSECURITY - Coggle Diagram
🤝 4️⃣ NCA ECC DOMAIN 4 — THIRD-PARTY CYBERSECURITY
4.1️⃣ Third-Party Cybersecurity Governance 🏢
4.1.1 Third-Party Security Policy 📜
Define supplier security requirements
Establish security responsibilities
Define compliance requirements
Define monitoring requirements
Define termination procedures
4.1.2 Third-Party Classification 📊
Critical Vendors 🔴
Access sensitive systems
Manage critical infrastructure
Business critical services
High Risk Vendors 🟠
Handle sensitive data
Remote system access
Medium Risk Vendors 🟡
Limited system access
Low Risk Vendors 🟢
No sensitive access
4.1.3 Third-Party Security Roles 👥
Vendor Manager
Cybersecurity Team
Risk Management Team
Legal Department
Business Owner
4.2️⃣ Third-Party Risk Management ⚠️
4.2.1 Vendor Security Assessment 🔍
Security Questionnaire
Compliance Review
Vulnerability Assessment
Penetration Testing Review
Security Certification Review
4.2.2 Risk Identification 📋
Data Exposure Risk
Access Risk
Malware Risk
Supply Chain Risk
Operational Risk
4.2.3 Risk Analysis 📈
Impact Assessment
Probability Analysis
Risk Rating
Risk Acceptance
4.2.4 Risk Treatment 🛡️
Reduce Risk
Additional Controls
Monitoring
Transfer Risk
Insurance / Contracts
Avoid Risk
Remove Vendor
Accept Risk
Management Approval
4.3️⃣ Third-Party Access Management 🔐
4.3.1 Access Control
Least Privilege Access
Role-Based Access Control (RBAC)
Temporary Access
Approval Process
4.3.2 Remote Access Security 🌐
VPN Access
Multi-Factor Authentication (MFA)
Privileged Access Management (PAM)
Session Monitoring
Remote Access Logging
4.3.3 Account Lifecycle Management 🔄
Account Creation
Access Modification
Periodic Review
Account Removal
4.3.4 Privileged Vendor Access 👑
Administrator Access Control
Password Vaulting
Session Recording
Activity Monitoring
4.4️⃣ Third-Party Data Protection 💾
4.4.1 Data Classification
Public Data
Internal Data
Confidential Data
Restricted Data
4.4.2 Data Handling Requirements
Data Storage Rules
Data Transfer Protection
Encryption Requirements
Data Retention
4.4.3 Data Sharing Security 🔒
Secure File Transfer
Encryption
Access Monitoring
Data Loss Prevention (DLP)
4.4.4 Data Disposal 🗑️
Secure Deletion
Media Destruction
Disposal Verification
4.5️⃣ Third-Party Security Monitoring 📊
4.5.1 Continuous Monitoring
Vendor Security Status
Threat Intelligence
Security Events
Compliance Status
4.5.2 Audit & Assessment 📋
Security Audits
Compliance Reviews
Evidence Collection
Findings Management
4.5.3 Security Reporting 📈
Risk Reports
Vendor Scorecards
Incident Reports
Management Dashboard
4.6️⃣ Supply Chain Security 🚚
Supplier Security
Hardware Suppliers
Software Suppliers
Service Providers
Software Supply Chain Security 💻
Code Security
Dependency Checking
Software Bill of Materials (SBOM)
Secure Development
Hardware Supply Chain Security ⚙️
Device Authenticity
Firmware Security
Hardware Integrity
Supply Chain Threats ⚠️
Backdoors
Compromised Updates
Counterfeit Components
Vendor Breaches
🎯 NCA ECC Domain 4 Implementation Workflow
1️⃣ Identify Third Parties 🤝
2️⃣ Classify Vendor Risk ⚠️
3️⃣ Perform Security Assessment 🔍
4️⃣ Apply Security Requirements 🛡️
5️⃣ Monitor Vendor Security 📊
6️⃣ Audit Compliance 📋
7️⃣ Review & Improve 🔄