Cybersecurity Risk and Governance of Third-Party Ecosystems

3 units

This graduate-level course examines cybersecurity risk as an enterprise management problem, emphasizing how security weaknesses, control gaps, and governance failures manifest in real-world incidents—particularly across third-party and supply-chain relationships. Using case studies drawn from notable breaches, outages, fraud events, and regulatory actions, students learn to translate technical risk into business impact and actionable executive oversight. The course is designed for current or aspiring CISO-level leaders and focuses on establishing and governing a comprehensive Third-Party Risk Management (TPRM) program. Students will develop the ability to set risk appetite and minimum security requirements for vendors, evaluate and prioritize third-party exposure, oversee due diligence and continuous monitoring, and ensure contract language, assurance mechanisms, and escalation paths align with organizational objectives. Topics include vendor segmentation and criticality, security questionnaires and evidence-based validation, audit and attestation frameworks, incident notification and response coordination, cloud/SaaS and managed service provider risk, fourth-party dependencies, data protection and privacy obligations, and reporting metrics suitable for senior leadership and boards. By the end of the course, students will be able to design and communicate an oversight model that balances security, speed, cost, and compliance—enabling resilient operations in a highly interconnected vendor ecosystem.