{"id":54712,"date":"2025-10-05T21:03:37","date_gmt":"2025-10-05T19:03:37","guid":{"rendered":"https:\/\/swissgrc.com\/ar\/?p=54712"},"modified":"2026-09-17T15:05:17","modified_gmt":"2026-09-17T13:05:17","slug":"what-third-party-cyber-risk-management-can-learn-from-established-security-functions","status":"publish","type":"post","link":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/","title":{"rendered":"What Third-Party Cyber Risk Management can learn from established security functions"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"54712\" class=\"elementor elementor-54712\" data-elementor-settings=\"{&quot;ha_cmc_init_switcher&quot;:&quot;no&quot;}\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-35a9138 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"35a9138\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-73cd8ab\" data-id=\"73cd8ab\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5b9f303 tt elementor-widget elementor-widget-text-editor\" data-id=\"5b9f303\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong><\/strong><\/p>\n<p id=\"ember3780\" class=\"ember-view reader-text-block__paragraph wp-block-paragraph\"><strong>In today\u2019s interconnected economy, the resilience of an organization is no longer defined only by its own security posture, but by the strength of its extended ecosystem. While third-party cyber risk management (TPCRM) has gained momentum in recent years, it is still evolving. Other domains, however &#8211; such as physical security and supply chain security &#8211; have already built mature frameworks and practices.<\/strong><\/p>\n<p id=\"ember3781\" class=\"ember-view reader-text-block__paragraph\"><strong>The question we should ask is: <\/strong><strong><em>What can TPCRM learn from these established third-party security functions?<\/em><\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-570026f elementor-widget elementor-widget-text-editor\" data-id=\"570026f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Looking beyond cyber: Learning from mature models<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f8d0b1e elementor-widget elementor-widget-text-editor\" data-id=\"f8d0b1e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p id=\"ember3783\" class=\"ember-view reader-text-block__paragraph\">Organizations have long faced third-party risks in the physical and supply chain realm. To manage these, entire standards and frameworks have been developed that embed <strong>risk-based approaches, certification schemes, and industry-wide trust models<\/strong>.<\/p>\n<p id=\"ember3784\" class=\"ember-view reader-text-block__paragraph\">Some examples include:<\/p>\n<ul>\n<li><strong>ISO 28000<\/strong> \u2013 A standard focusing on security management systems for the supply chain. It defines how to identify critical assets, assess risks, and build resilience across logistics networks.<\/li>\n<li><strong>TAPA FSR (Transported Asset Protection Association &#8211; Facility Security Requirements)<\/strong> \u2013 A framework widely used in logistics and warehousing to protect high-value goods, with a strong focus on auditable controls and certifications.<\/li>\n<li><strong>CTPAT (Customs Trade Partnership Against Terrorism)<\/strong> \u2013 A US government\u2013business initiative that ensures importers and supply chain partners implement rigorous security practices to safeguard global trade.<\/li>\n<\/ul>\n<div>\u00a0<\/div>\n<p id=\"ember3786\" class=\"ember-view reader-text-block__paragraph\">These frameworks have one thing in common: they <strong>don\u2019t just rely on questionnaires<\/strong> or self-attestations. They embed <strong>standardized controls, verification mechanisms, and industry trust networks<\/strong>.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d252e6f elementor-widget elementor-widget-text-editor\" data-id=\"d252e6f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong><\/strong><\/p>\n<p class=\"wp-block-paragraph\">There&#8217;s no need for cybersecurity to reinvent the wheel<\/p>\n<p><strong><\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-102a066 elementor-widget elementor-widget-text-editor\" data-id=\"102a066\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p id=\"ember3788\" class=\"ember-view reader-text-block__paragraph\">Too often, <a href=\"https:\/\/swissgrc.com\/en\/tprm-software\" target=\"_blank\" rel=\"noopener\">third-party<\/a> cyber risk management programs rely heavily on spreadsheets, lengthy questionnaires, and inconsistent monitoring. Compared to physical security, this feels immature.<\/p>\n<p id=\"ember3789\" class=\"ember-view reader-text-block__paragraph\">Drawing inspiration from ISO 28000, TAPA FSR, and CTPAT, we can identify three lessons:<\/p>\n<ol>\n<li><strong>Risk-Based Tiering:<\/strong> Not all suppliers are equal. Just as CTPAT differentiates risk tiers in supply chains, TPCRM should define differentiated assurance levels &#8211; high-risk vendors require continuous monitoring and certification, low-risk vendors require lighter oversight.<\/li>\n<li><strong>Independent Validation:<\/strong> Physical security frameworks rely on accredited audits and certifications. Cybersecurity can follow this model by integrating <strong>independent attestation standards<\/strong> (e.g., ISO 27001, ISAE 3000, SOC 2) and industry consortia that reduce redundancy across assessments.<\/li>\n<li><strong>Shared Responsibility Networks:<\/strong> TAPA and CTPAT thrive because they are <strong>industry communities<\/strong>: members share intelligence and benchmarks. Cyber TPCRM should evolve towards similar <strong>collaborative ecosystems <\/strong>(cf. <a class=\"hIUybjcrkfFLLhBnSNRPGtyujTqztdM \" tabindex=\"0\" href=\"https:\/\/fscsc.ch\/en\/\" target=\"_blank\" rel=\"noopener\" data-test-app-aware-link=\"\">Swiss FS-CSC<\/a>), where risk intelligence is pooled, rather than every company reinventing the wheel.<\/li>\n<\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-214c819 elementor-widget elementor-widget-text-editor\" data-id=\"214c819\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong><\/strong><\/p>\n<p class=\"wp-block-paragraph\">Towards an integrated view of security<\/p>\n<p><strong><\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-25c2b32 elementor-widget elementor-widget-text-editor\" data-id=\"25c2b32\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The lesson is clear: Third-party cyber risk management should <strong>not be an isolated silo<\/strong>. It should be seen as part of a broader <a href=\"https:\/\/asisonline.org\/security-news\/security-topics\/esrm\/\" target=\"_blank\" rel=\"noopener\"><strong>Enterprise Security Risk Management<\/strong><\/a><strong> (ESRM)<\/strong> approach, where logical, physical, and personnel security are converged.<\/p>\n<p>If we align cyber TPCRM with established physical and supply chain models, we can accelerate maturity, reduce redundancy, and &#8211; most importantly &#8211; build real trust across the value chain.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ddbd271 elementor-widget elementor-widget-text-editor\" data-id=\"ddbd271\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><strong><\/strong><\/p>\n<p class=\"wp-block-paragraph\">Conclusion<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8b90e73 elementor-widget elementor-widget-text-editor\" data-id=\"8b90e73\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p id=\"ember3795\" class=\"ember-view reader-text-block__paragraph\">Cybersecurity leaders don\u2019t need to start from scratch. Decades of experience in <strong>physical and supply chain third-party security<\/strong> have already shown what works: risk-based tiering, independent validation, and trusted communities.<\/p>\n<p id=\"ember3796\" class=\"ember-view reader-text-block__paragraph\">As CISOs and risk advisors, our task is not just to protect the digital perimeter, but to embed <strong>cyber resilience into the same trust frameworks that already safeguard goods, people, and supply chains<\/strong>.<\/p>\n<p id=\"ember3797\" class=\"ember-view reader-text-block__paragraph\"><strong>What about you, do you see further lessons TPCRM can learn from already established functions?<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>In today\u2019s interconnected economy, an organization\u2019s resilience depends not only on its own security posture but on the strength of its extended ecosystem. While third-party cyber risk management (TPCRM) is evolving, physical and supply chain security have long established mature frameworks. The question is: What can TPCRM learn from them?<\/p>\n","protected":false},"author":31,"featured_media":54714,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"_eb_attr":"","_swissgrc_real_author":"Marc Etienne Cortesi","real_author_title":"CISO, Baloise Group","real_author_bio":"Marc Etienne Cortesi is Chief Information Security Officer (CISO) at Baloise Group and a Board Member of the Swiss Financial Center \u2013 Cyber Security Centre. He also lectures in the Information & Cyber Security master's program at the Lucerne University of Applied Sciences and Arts.","real_author_photo":54710,"footnotes":"","_links_to":"","_links_to_target":""},"categories":[29,68],"tags":[],"class_list":["post-54712","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-information-security","category-tprm"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Marc Etienne Cortesi\"\/>\n\t<meta name=\"google-site-verification\" content=\"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ar_AR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Third-Party Cyber Risk Management: Lessons from Security\" \/>\n\t\t<meta property=\"og:description\" content=\"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/10\/TPRM.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/10\/TPRM.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2025-10-05T19:03:37+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-17T13:05:17+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Third-Party Cyber Risk Management: Lessons from Security\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@SwissGRC\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/10\/TPRM.jpg\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"Marc Etienne Cortesi\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#blogposting\",\"name\":\"Third-Party Cyber Risk Management: Lessons from Security\",\"headline\":\"What Third-Party Cyber Risk Management can learn from established security functions\",\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/marccortesi\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2025\\\/10\\\/TPRM.jpg\",\"width\":1280,\"height\":720,\"caption\":\"What Third-Party Cyber Risk Management can learn from established security functions\"},\"datePublished\":\"2025-10-05T21:03:37+02:00\",\"dateModified\":\"2026-09-17T15:05:17+02:00\",\"inLanguage\":\"ar\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#webpage\"},\"articleSection\":\"Information Security, TPRM\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/information-security\\\/#listItem\",\"name\":\"Information Security\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/information-security\\\/#listItem\",\"position\":2,\"name\":\"Information Security\",\"item\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/information-security\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#listItem\",\"name\":\"What Third-Party Cyber Risk Management can learn from established security functions\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#listItem\",\"position\":3,\"name\":\"What Third-Party Cyber Risk Management can learn from established security functions\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/category\\\/information-security\\\/#listItem\",\"name\":\"Information Security\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\",\"name\":\"Swiss GRC AG\",\"description\":\"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"telephone\":\"+41412207500\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/en\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2023\\\/06\\\/Logo_V1_Original_mit_Claim.png\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.twitter.com\\\/SwissGRC\",\"https:\\\/\\\/www.instagram.com\\\/swissgrc\\\/\",\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCy4QuXYekCQrA4n5oEwJSJg\",\"https:\\\/\\\/ch.linkedin.com\\\/company\\\/swissgrc\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/marccortesi\\\/#author\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/marccortesi\\\/\",\"name\":\"Marc Etienne Cortesi\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/966e28341278739aa9e60ba2db89e1c54aec543d55e7368e46b26e12270e7fd9?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Marc Etienne Cortesi\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#webpage\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/\",\"name\":\"Third-Party Cyber Risk Management: Lessons from Security\",\"description\":\"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.\",\"inLanguage\":\"ar\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/marccortesi\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/author\\\/marccortesi\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/wp-content\\\/uploads\\\/sites\\\/5\\\/2025\\\/10\\\/TPRM.jpg\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#mainImage\",\"width\":1280,\"height\":720,\"caption\":\"What Third-Party Cyber Risk Management can learn from established security functions\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\\\/#mainImage\"},\"datePublished\":\"2025-10-05T21:03:37+02:00\",\"dateModified\":\"2026-09-17T15:05:17+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#website\",\"url\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/\",\"name\":\"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM\",\"description\":\"Governance, Risk & Compliance (GRC)\",\"inLanguage\":\"ar\",\"publisher\":{\"@id\":\"https:\\\/\\\/swissgrc.com\\\/ar\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>Third-Party Cyber Risk Management: Lessons from Security<\/title>\n\n","aioseo_head_json":{"title":"Third-Party Cyber Risk Management: Lessons from Security","description":"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.","canonical_url":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"google-site-verification":"google-site-verification=BAztS2wKP0jEfbvHt4_mrvvD17WwzZg1w1A6R9uoQRU","miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#blogposting","name":"Third-Party Cyber Risk Management: Lessons from Security","headline":"What Third-Party Cyber Risk Management can learn from established security functions","author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/marccortesi\/#author"},"publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/10\/TPRM.jpg","width":1280,"height":720,"caption":"What Third-Party Cyber Risk Management can learn from established security functions"},"datePublished":"2025-10-05T21:03:37+02:00","dateModified":"2026-09-17T15:05:17+02:00","inLanguage":"ar","mainEntityOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#webpage"},"isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#webpage"},"articleSection":"Information Security, TPRM"},{"@type":"BreadcrumbList","@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","position":1,"name":"Home","item":"https:\/\/swissgrc.com\/ar\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/information-security\/#listItem","name":"Information Security"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/information-security\/#listItem","position":2,"name":"Information Security","item":"https:\/\/swissgrc.com\/ar\/category\/information-security\/","nextItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#listItem","name":"What Third-Party Cyber Risk Management can learn from established security functions"},"previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#listItem","position":3,"name":"What Third-Party Cyber Risk Management can learn from established security functions","previousItem":{"@type":"ListItem","@id":"https:\/\/swissgrc.com\/ar\/category\/information-security\/#listItem","name":"Information Security"}}]},{"@type":"Organization","@id":"https:\/\/swissgrc.com\/ar\/#organization","name":"Swiss GRC AG","description":"Swiss GRC delivers Software Solutions for GRC, CLM &amp; BPM, helping businesses worldwide manage risks, ensure compliance, and drive success.","url":"https:\/\/swissgrc.com\/ar\/","telephone":"+41412207500","logo":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/en\/wp-content\/uploads\/sites\/2\/2023\/06\/Logo_V1_Original_mit_Claim.png","@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#organizationLogo"},"image":{"@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#organizationLogo"},"sameAs":["https:\/\/www.twitter.com\/SwissGRC","https:\/\/www.instagram.com\/swissgrc\/","https:\/\/www.youtube.com\/channel\/UCy4QuXYekCQrA4n5oEwJSJg","https:\/\/ch.linkedin.com\/company\/swissgrc"]},{"@type":"Person","@id":"https:\/\/swissgrc.com\/ar\/author\/marccortesi\/#author","url":"https:\/\/swissgrc.com\/ar\/author\/marccortesi\/","name":"Marc Etienne Cortesi","image":{"@type":"ImageObject","@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/966e28341278739aa9e60ba2db89e1c54aec543d55e7368e46b26e12270e7fd9?s=96&d=mm&r=g","width":96,"height":96,"caption":"Marc Etienne Cortesi"}},{"@type":"WebPage","@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#webpage","url":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/","name":"Third-Party Cyber Risk Management: Lessons from Security","description":"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.","inLanguage":"ar","isPartOf":{"@id":"https:\/\/swissgrc.com\/ar\/#website"},"breadcrumb":{"@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#breadcrumblist"},"author":{"@id":"https:\/\/swissgrc.com\/ar\/author\/marccortesi\/#author"},"creator":{"@id":"https:\/\/swissgrc.com\/ar\/author\/marccortesi\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/10\/TPRM.jpg","@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#mainImage","width":1280,"height":720,"caption":"What Third-Party Cyber Risk Management can learn from established security functions"},"primaryImageOfPage":{"@id":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/#mainImage"},"datePublished":"2025-10-05T21:03:37+02:00","dateModified":"2026-09-17T15:05:17+02:00"},{"@type":"WebSite","@id":"https:\/\/swissgrc.com\/ar\/#website","url":"https:\/\/swissgrc.com\/ar\/","name":"Swiss GRC - Software Solutions for GRC, CLM &amp; BPM","description":"Governance, Risk & Compliance (GRC)","inLanguage":"ar","publisher":{"@id":"https:\/\/swissgrc.com\/ar\/#organization"}}]},"og:locale":"ar_AR","og:site_name":"Swiss GRC AR | Governance, Risk &amp; Compliance (GRC)","og:type":"article","og:title":"Third-Party Cyber Risk Management: Lessons from Security","og:description":"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.","og:url":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/","og:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/10\/TPRM.jpg","og:image:secure_url":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/10\/TPRM.jpg","og:image:width":1280,"og:image:height":720,"article:published_time":"2025-10-05T19:03:37+00:00","article:modified_time":"2026-09-17T13:05:17+00:00","twitter:card":"summary_large_image","twitter:site":"@SwissGRC","twitter:title":"Third-Party Cyber Risk Management: Lessons from Security","twitter:description":"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.","twitter:creator":"@SwissGRC","twitter:image":"https:\/\/swissgrc.com\/ar\/wp-content\/uploads\/sites\/5\/2025\/10\/TPRM.jpg","twitter:label1":"Written by","twitter:data1":"Marc Etienne Cortesi","twitter:label2":"Est. reading time","twitter:data2":"3 minutes"},"aioseo_meta_data":{"post_id":"54712","title":"Third-Party Cyber Risk Management: Lessons from Security","description":"Marc Etienne Cortesi, CISO at Baloise, shares how third-party cyber risk management can evolve by learning from physical and supply chain security models.","keywords":null,"keyphrases":{"focus":{"keyphrase":"Third-Party Cyber Risk Management","score":84},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":true,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-09-17 13:05:22","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2025-10-05 18:52:58","updated":"2026-09-17 13:15:41","focus_keyword":"Third-Party Cyber Risk Management","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/swissgrc.com\/ar\/category\/information-security\/\" title=\"Information Security\">Information Security<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tWhat Third-Party Cyber Risk Management can learn from established security functions\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/swissgrc.com\/ar\/"},{"label":"Information Security","link":"https:\/\/swissgrc.com\/ar\/category\/information-security\/"},{"label":"What Third-Party Cyber Risk Management can learn from established security functions","link":"https:\/\/swissgrc.com\/ar\/what-third-party-cyber-risk-management-can-learn-from-established-security-functions\/"}],"_links":{"self":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/54712","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/users\/31"}],"replies":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/comments?post=54712"}],"version-history":[{"count":40,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/54712\/revisions"}],"predecessor-version":[{"id":54758,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/posts\/54712\/revisions\/54758"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media\/54714"}],"wp:attachment":[{"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/media?parent=54712"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/categories?post=54712"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/swissgrc.com\/ar\/wp-json\/wp\/v2\/tags?post=54712"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}