Define a third-party risk domain

A risk domain defines the type of risk to assess for a third party. For example, you might want to assess a data-management third party in terms of security risk and a bank in terms of financial risk. Security risk and financial risk are risk domains. Some platform applications refer to risk domains as "risk areas."

Before you begin

Role required: sn_vdr_risk_asmt.vendor_risk_manager

About this task

Note: Risk domains are called "risk areas" in some platform applications.

You can better understand and mitigate the risks that a third party poses to your organization by identifying the domains of their business to assess for risk and quantifying the importance (weight) of each domain.

• Security risk domain: A third party that handles sensitive personal data in their infrastructure might need to be assessed against their security posture.
• Reputational risk domain: If that personal data were breached, it could cause damage to your reputation due to negative media attention.
• Financial risk domain: If a third party fails to deliver on time, you might have to pay fines, settlements, or both resulting in financial loss.

In this procedure, you create a Risk domain definition. In each definition, you specify the criteria that determine which organizations should be assessed for a particular type of risk.

Note: Risk domain definitions are called Risk area definitions on the forms.

Procedure

1. Navigate to All > Third-party Risk Management > Scoring Setup > Risk Domains.

1. Select New, fill in the form, and then select Submit.