Risk Ledger is running a joint trial project with FS-ISAC in the UK to understand the number and types of concentration risks that exist within the supply chains of financial services firms.
The project will provide FS-ISAC members who are taking part with the ability to gain greater visibility into their extended supply chains, including 4th, 5th and nth parties to increase operational resilience, and meet some DORA requirements. Upon completion of this trial project, we are planning to run a larger project with FS-ISAC members.
Register today to receive the final report at the end of the project, including key findings, recommendations and details on how to join a potential follow-up project.
The project will allow FS-ISAC members to connect to their suppliers on the Risk Ledger platform, and provide project participants with data on the security and resilience of their connected suppliers.
The project will use Risk Ledger’s relationship-based data to map out the supplier ecosystems of the project participants, and help them identify 4th, 5th and nth party relationships and dependencies.
The project will use Risk Ledger’s concentration risk algorithm to automatically detect suppliers who introduce concentration risks to the FS supplier ecosystem.
The project will enable FS-ISAC members to collaborate with each other and share new data to enhance their TPRM processes as part of an FS-ISAC led community.
A tier-1 bank used Risk Ledger during a cyber
innovation challenge to uncover potential blindspots further down their supply chain. Their aim was to showcase their supply chain map in a meeting with regulators the following week. Within 48 hours they were
able to get a clear overview of their entire supply chain,
far beyond their immediate direct suppliers.
What they discovered:
Using Risk Ledger, the bank was able to identify:
- 14 third parties
- 36 fourth parties
- 175 fifth parties
- 15 sixth parties
- 27 seventh parties
- and crucially, 7 concentration risks
In addition they were able to trace knock-on effects
of potential emerging supply chain attacks such
as Solarwinds or Log4J through uncovering these
dependencies in their supply chain.