Third-party risk management: Strategy to mitigate ‘on-premise’ and ‘cloud’ cyber security risks
Bibliographic record
Abstract
This paper will attempt to exhaustively identify third-party partnership risks and describe requirements applicable to this relationship in the IT security business context. These entities have, either long-term or for an ad hoc period, occasional access to premises, infrastructures and/or data belonging to this organisation. These physical and logical accesses are a source of risk that all organisations should work to mitigate and avoid the materialisation of related threats and impacts that could jeopardise the achievement of their business objectives. Third-party risk management is the set of risk management practices and processes that adequately mitigate the risks inherent to the relationships between the company and its partners. These partners are identified by the designation of ‘third parties’. The mitigation of risks will be considered convenient if it ensures information assets security and compliance with legal and regulatory requirements and security requirements policies and guidelines. Mitigating these risks requires a different strategy depending on the type of business relationship and the nature of the service. The strategy applied to services delivered by a partner during an ‘on-site’ or ‘on-premise’ relationship has features that are not applicable to cloud-based services. The increasing attraction for cloud services — even for companies considered historically as refractory — requires particular attention to risks associated with this new reality of services. In North America (Canada and US) the use of cloud computing is becoming increasingly important in the public sector (such as government, hospitals) and the private sector operating in sensitive environments (such as ICS/SCADA networks). This paper, which is intended to be a practical tool for developing an IT risk management strategy with third parties, is applicable specifically in technology environments for both on-premises and cloud deployment. It applies to risks related to technological components in multi-client environments as well as dedicated service to specific customers.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.024 | 0.029 |
| Meta-epidemiology (narrow) | 0.002 | 0.001 |
| Meta-epidemiology (broad) | 0.001 | 0.002 |
| Bibliometrics | 0.004 | 0.002 |
| Science and technology studies | 0.005 | 0.006 |
| Scholarly communication | 0.020 | 0.015 |
| Open science | 0.004 | 0.018 |
| Research integrity | 0.007 | 0.009 |
| Insufficient payload (model declined to judge) | 0.005 | 0.003 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".