During this period of digital transformations TPRM is the buzz word for most of the corporate services. When TPRM deals with analyzing and controlling risks attached to the operations, data and finance of the organization the technology which acts as the third party is equally important. When Internet of things is changing the face of corporate innovation, it needs more cross divisional collaboration. The IoT ecosystem includes networks, platforms, devices that requires multiple security protection measures at each layer, as well as intelligence and security protection steps at every layer of the security

IoT provides major benefits against Risk Management in the fields of construction, aviation and nature catastrophe by alarming and preventing major disruptions. But when we come to the context of third party risk management programs unsecured IOT devices acts as a major threat to the vendors causing failure due to data breach and cyber-attacks.

Most of the organizations have already identified the growing risk an IOT device brings in when connected to a corporate network by a third party suddenly compromised. Policies in place for corporates need to be more focused on IoT devices and its application from the view of the third party.

When there is an increase dependency on IoT devices in workplaces, organizations should we able to assess the magnitude of related risk with the same. The need for assessing the gap between the internal and third party IoT monitoring is necessary

“To build pervasive security across that third party ecosystem, you not only need to know who those third parties are and what they’re doing for you.” Edna Conway,Chief Security Officer, Global Value Chain at Cisco

When we focus more on the internal workplace IoT device risks, we ignore the vulnerability caused by the negligence of risk posed by the third party, to mitigate the risk there are certain steps to be taken such as:

• The assets procured by the asset management and inventory systems should include the IoT devices and applications and become aware of the security features of the devices. If anything seems to be inadequate should be replaced.
• Accountability for approval, monitoring, use and deployment of IoT devices should be clearly mentioned.
• The IoT related third party controls should be verified, such as the contract clauses, privacy related policies and procedures.
• Always monitor and identify the best practices to in the industry to mitigate the IoT device and application risks.

IoT is no more about things or even data, it is beyond using sensors and collecting data. There is a need for creating a framework for using the definitive information and collecting the data. This change is happening at a faster pace that neglecting can cost major transformation of tomorrow.