-(2).png)
Cybersecurity was once viewed mainly through internal controls. Today, that perspective is no longer sufficient. Organisations in Malaysia increasingly rely on vendors, cloud providers, managed service providers and other external partners with access to critical systems, sensitive information and essential business processes.
The reality for leadership is clear: an organisation’s cybersecurity posture is only as strong as the third parties connected to it. A weakness within one critical vendor can expose the organisation to operational disruption, regulatory consequences, financial loss and reputational damage.
Accountability may also be fragmented across procurement, information technology, cybersecurity, legal, compliance, risk management, data protection and individual business functions. Each function may perform a part of the process, but no single stakeholder maintains an enterprise-wide view of exposure. This is fundamentally a governance issue. Cybersecurity governance should define how these functions work together, who owns each third-party risk, who provides independent challenge, and who makes the final decision to approve, reject, remediate, suspend or terminate a high-risk relationship.
A common example occurs when a business uses a Software-as-a-Service (SaaS) solution to improve productivity. The platform may be approved quickly to meet business deadlines, with limited review of where the data is processed, who has access to the information, how customer data is stored, or whether the vendor relies on additional subcontractors. What begins as a business convenience can later become a cybersecurity, privacy and regulatory risk if proper governance is not applied.
Third-party cyber risk must therefore be managed as an enterprise risk, rather than solely as a procurement or compliance exercise. Without this governance structure, third-party risks may be assessed inconsistently, accepted without appropriate authority or overlooked after the vendor has been onboarded.
Many organisations still assess vendors primarily during procurement. However, a cloud service provider used today may introduce new technology, move data centres, engage additional subcontractors or expand its service offerings within a year. Unless the organisation continues to monitor these changes, decisions may be made based on assumptions that are no longer valid.
Governance also ensures that cybersecurity responsibilities are clearly defined across procurement, information technology, cybersecurity, legal, compliance and business functions. Each critical vendor should have an accountable business owner, while residual cyber risks should be accepted only by individuals with the appropriate authority.
Cybersecurity must also be embedded into contracts. Requirements should address areas such as access control, data protection, incident notification, vulnerability management, audit rights, subcontractor use, business continuity and secure termination.
Not all vendors present the same level of risk. A stationery supplier delivering office supplies does not require the same level of cybersecurity scrutiny as a cloud provider hosting sensitive business data, or a managed security service provider monitoring critical systems. Effective governance helps organisations focus resources on vendors that matter most from a risk perspective.
A frequently overlooked example involves SaaS providers that host their solutions on major cloud service providers. During vendor assessments, SaaS providers may rely on the cloud provider's certifications, audit reports or security attestations as evidence of their own security assurance. While the underlying cloud platform may be well-secured, those certifications typically cover only the cloud infrastructure and not necessarily the SaaS provider's own application security, access management, software development practices, customer data handling controls or operational processes. In effect, organisations may gain assurance over the foundations but have limited visibility over the controls implemented by the SaaS provider itself. This can create a false sense of confidence if the distinction between inherited controls and provider-specific controls is not clearly understood.
Critical vendors should therefore be monitored throughout the relationship. This may include periodic reassessments, review of security reports, tracking of remediation actions and reassessment following significant changes or cyber incidents.
Third parties supporting critical services should also be included in incident response, business continuity and recovery exercises. This helps ensure that responsibilities, reporting requirements and recovery arrangements are understood before an actual disruption occurs.
For example, an organisation may engage a cloud provider to host a business application. Several years later, the provider may migrate its services to a new platform, adopt artificial intelligence capabilities, or engage additional subcontractors to support its operations. While these changes may improve service delivery, they can also introduce new risks that were never evaluated during the original onboarding assessment. Continuous oversight helps ensure that these changes remain aligned with the organisation's risk appetite and security requirements.
When cybersecurity governance is effective, the organisation gains more than vendor oversight. It gains visibility over external dependencies, clarity over accountability, greater confidence in critical services, and a stronger ability to anticipate, withstand, respond to and recover from disruptions across its extended enterprise.
Strengthening third-party cyber risk requires more than point-in-time vendor assessments. BDO Malaysia’s Cybersecurity and Data Privacy team can help you assess third-party cyber risks, strengthen governance and build greater resilience across your organisation’s extended enterprise.
Learn more about BDO Malaysia’s cybersecurity and data privacy services today.
Learn More
The reality for leadership is clear: an organisation’s cybersecurity posture is only as strong as the third parties connected to it. A weakness within one critical vendor can expose the organisation to operational disruption, regulatory consequences, financial loss and reputational damage.
Why Third-Party Cyber Risk Gaps Persist
The challenge rarely stems from a single control failure. Instead, it develops gradually across the vendor lifecycle:- Vendors are frequently onboarded to meet urgent business objectives, while cybersecurity due diligence is treated as a compliance exercise rather than an effective risk control.
- Assessments may rely heavily on self-declared questionnaires without sufficient validation or supporting evidence.
- Contracts may lack enforceable cybersecurity requirements, and once vendors become operational, oversight often diminishes to periodic administrative reviews.
Accountability may also be fragmented across procurement, information technology, cybersecurity, legal, compliance, risk management, data protection and individual business functions. Each function may perform a part of the process, but no single stakeholder maintains an enterprise-wide view of exposure. This is fundamentally a governance issue. Cybersecurity governance should define how these functions work together, who owns each third-party risk, who provides independent challenge, and who makes the final decision to approve, reject, remediate, suspend or terminate a high-risk relationship.
A common example occurs when a business uses a Software-as-a-Service (SaaS) solution to improve productivity. The platform may be approved quickly to meet business deadlines, with limited review of where the data is processed, who has access to the information, how customer data is stored, or whether the vendor relies on additional subcontractors. What begins as a business convenience can later become a cybersecurity, privacy and regulatory risk if proper governance is not applied.
Governance Has Outgrown the Vendor Checklist
Third-party risk management is often limited to onboarding questionnaires, security certifications and periodic reviews. However, these point-in-time activities may not reflect changes in a vendor’s technology, subcontracting arrangements, security controls or threat environment.Third-party cyber risk must therefore be managed as an enterprise risk, rather than solely as a procurement or compliance exercise. Without this governance structure, third-party risks may be assessed inconsistently, accepted without appropriate authority or overlooked after the vendor has been onboarded.
Many organisations still assess vendors primarily during procurement. However, a cloud service provider used today may introduce new technology, move data centres, engage additional subcontractors or expand its service offerings within a year. Unless the organisation continues to monitor these changes, decisions may be made based on assumptions that are no longer valid.
Why Good Cybersecurity Governance Matters
Strong cybersecurity governance connects third-party risk management to the organisation’s cybersecurity strategy, enterprise risk management framework and risk appetite. Rather than applying the same level of scrutiny to every vendor, organisations should prioritise third parties based on their access to sensitive information, critical systems, privileged accounts and essential business processes. This allows greater attention to be directed towards relationships that could have the most significant impact.Governance also ensures that cybersecurity responsibilities are clearly defined across procurement, information technology, cybersecurity, legal, compliance and business functions. Each critical vendor should have an accountable business owner, while residual cyber risks should be accepted only by individuals with the appropriate authority.
Cybersecurity must also be embedded into contracts. Requirements should address areas such as access control, data protection, incident notification, vulnerability management, audit rights, subcontractor use, business continuity and secure termination.
Not all vendors present the same level of risk. A stationery supplier delivering office supplies does not require the same level of cybersecurity scrutiny as a cloud provider hosting sensitive business data, or a managed security service provider monitoring critical systems. Effective governance helps organisations focus resources on vendors that matter most from a risk perspective.
A frequently overlooked example involves SaaS providers that host their solutions on major cloud service providers. During vendor assessments, SaaS providers may rely on the cloud provider's certifications, audit reports or security attestations as evidence of their own security assurance. While the underlying cloud platform may be well-secured, those certifications typically cover only the cloud infrastructure and not necessarily the SaaS provider's own application security, access management, software development practices, customer data handling controls or operational processes. In effect, organisations may gain assurance over the foundations but have limited visibility over the controls implemented by the SaaS provider itself. This can create a false sense of confidence if the distinction between inherited controls and provider-specific controls is not clearly understood.
Oversight Must Continue Throughout the Relationship
A vendor’s cybersecurity risk profile can change after onboarding. New technologies, subcontractors, system access arrangements and cyber threats may introduce risks that were not present during the initial assessment.Critical vendors should therefore be monitored throughout the relationship. This may include periodic reassessments, review of security reports, tracking of remediation actions and reassessment following significant changes or cyber incidents.
Third parties supporting critical services should also be included in incident response, business continuity and recovery exercises. This helps ensure that responsibilities, reporting requirements and recovery arrangements are understood before an actual disruption occurs.
For example, an organisation may engage a cloud provider to host a business application. Several years later, the provider may migrate its services to a new platform, adopt artificial intelligence capabilities, or engage additional subcontractors to support its operations. While these changes may improve service delivery, they can also introduce new risks that were never evaluated during the original onboarding assessment. Continuous oversight helps ensure that these changes remain aligned with the organisation's risk appetite and security requirements.
Strengthening Third-Party Cyber Risk
In today’s interconnected environment, third party risk is no longer solely a procurement concern. It is a cybersecurity governance issue that requires leadership accountability.When cybersecurity governance is effective, the organisation gains more than vendor oversight. It gains visibility over external dependencies, clarity over accountability, greater confidence in critical services, and a stronger ability to anticipate, withstand, respond to and recover from disruptions across its extended enterprise.
Strengthening third-party cyber risk requires more than point-in-time vendor assessments. BDO Malaysia’s Cybersecurity and Data Privacy team can help you assess third-party cyber risks, strengthen governance and build greater resilience across your organisation’s extended enterprise.
Learn more about BDO Malaysia’s cybersecurity and data privacy services today.
Learn More