Good Afternoon,
I'm curious to hear perspectives on how your TPRM program treats third-party technology installed on-premise/on-site, versus a hosted or SaaS type relationship. We designed our risk assessment to elevate the risk of technology engagements where the third party has off-site access to sensitive information, hosts or manages tech on our behalf, or accesses our network (in addition to other non-tech specific attributes). Thus, we are focusing on hosted/outsourced tech and not on-premise tech. Do your programs perform due diligence on third parties that provide tech that is installed on-premise?
Tim