BLOG

Teaching a Vendor to Phish: How to Help Your Vendors Remediate Cyber Risks

Identifying the cybersecurity gaps in your vendor ecosystem is only one part of solving for risk. Risk management and reduction can only be achieved when third-party risk management programs make concrete investments to support their vendors in making timely and cost-effective improvements in their cybersecurity program. Here at CORL, we are committed to more than risk measurement. We foster excellence and accountability on both sides of the vendor contract by actively championing and managing proactive remediation and risk maintenance. Read More

Published On June 2, 2022

Keep Up with CORL: Vendor Breach Digest, 5/9/22

Our Vendor Breach Digest provides a summary roll-up of major breach events for third-party vendors operating within the healthcare supply chain. Breaches covered in this release: Okta & Microsoft, SummaCare, Healthplex, Inc, GitHub, Arcare, American Dental Association, T-Mobile, Mental Health Center of Greater Manchester, Mountain Area Health Education Center, The State Bar of Georgia, McCarter & English, Kaiser Foundation, Health Plan, Touchstone Imaging, DialAmerica Marketing, Block, Parker Hannifin Corporation, MailChimp, HubSpot, Cytometry Specialists, Palo Alto Networks, Globant, and Gainwell Technologies. Read More

Published On May 9, 2022

Mitigating Fourth-Party Cyber Risks in Healthcare

This blog post provides insights into the growing risks associated with fourth-party vendors and applications that many healthcare organizations have not yet addressed. The objective of this publication is to level set definitions for fourth-party risk, outline current risk mitigation models and challenges, and propose innovative approaches for mitigating supply chain risks that extend to fourth parties. Read More

Published On April 21, 2022

Keep Up with CORL: Vendor Breach Digest, 3/15/22

Our Vendor Breach Digest provides a summary roll-up of major breach events for third-party vendors operating within the healthcare supply chain. Breaches covered in this release: Morley Companies, South Denver Cardiology Associates, Securitas, Priority Health, Medical Healthcare Solutions, PracticeMax, Charlotte Radiology, RR Donnelley, US Radiology Specialists, Pekin Insurance, The International Committee of the Red Cross, DataHEALTH, American Osteopathic Association, Vantage Holding Company, Crossroads Health, UMass Memorial Health, LGAA... Read More

Published On March 15, 2022

Russia/Ukraine Cyberwar: Healthcare Vendor Risks & Response

Healthcare organizations are scrambling to adjust their cybersecurity preparation and response capabilities in the wake of potential cyberattacks stemming from the ongoing conflict between Russia and Ukraine. This blog post provides threat intelligence on the escalating cyberwar activities stemming from this conflict as well as recommendations for healthcare vendor risk management programs to prepare and respond to these emerging threats. Read More

Published On March 4, 2022

Obtaining Buy-In for Your Third-Party Risk Management Program

Third-party risk management breaches have been snowballing in recent months with no clear end in sight. However, too many healthcare organizations have maintained a status quo approach to their Third-Party Risk Management (TPRM) and Vendor Risk Management (VRM) programs. This blog provides recommendations for delivering messaging to key stakeholder groups within healthcare entities to make the business case for further investments in third-party risk programs. Read More

Published On February 1, 2022

Keep Up with CORL: Vendor Breach Digest, 1/17/22

Our Vendor Breach Digest provides a summary roll-up of major breach events for third-party vendors operating within the healthcare supply chain. Breaches covered in this release: Kronos, Microsoft Exchange Outlook Web Access, BioPlus, QRS, BDO, The Medical Review Institute of America, Doxy.me, Jefferson Surgical Clinic, EMI Health, Neuro-Rehab Associates, UScellular, Georgia Bone and Joint Surgeons, Anthem, Walgreens, Daniel J. Edelman Holdings, A New Leaf Inc, Ibex, Ciox Health, Broward Health, UAW Retiree Medical Benefits, T-Mobile, Southern Orthopaedic Association, CompuGroup Medical & Bertelsmann, and Fiondella, Milone & LaSaracina LLP. Read More

Published On January 17, 2022

Urgent Vendor Risk Alert: Log4j Java/Apache Logging Vulnerability

A far-spanning zero-day vulnerability was exposed over the weekend for the ubiquitous open-sourced logging utility called Log4j. CORL is actively working with our customers and vendor population to understand the extent of deployment of Log4j in the vendor community and the impact and risk exposure it may create for our customers. This blog provides a short summary of the Log4j vulnerability, as well as recommendations for remediation and risk mitigation for organizations and their third-party vendors. Read More

Published On December 13, 2021

Featured Blog Posts

Webinar Recap: A Clear Path to Solving for Risk: A Bold New Standard for TPRM

Read

What do the barrier reef and vendor risk have in common? Here’s what healthcare TPRM can learn from this year’s coral cover numbers.

Read

CISA Cyber Performance Goals: Third-Party & Supply Chain Requirements

Read

Keep Up with CORL: Vendor Breach Digest, 10/11/22

Read