Cybersecurity is a concern for organizations in this era. However, strengthening the security of an organization’s internal network may not be sufficient since modern organizations depend on third parties, and these dependencies may open new attack paths to cybercriminals. Cyber Third-Party Risk Management (C-TPRM) is a relatively new concept in the business world. All vendors or partners possess a potential security vulnerability and threat. Even if an organization has the best cybersecurity practice, its data, customers, and reputation may be at risk because of a third party. Organizations seek effective and efficient methods to assess their partners’ cybersecurity risks. In addition to intrusive methods to assess an organization’s cybersecurity risks, such as penetration testing, non-intrusive methods are emerging to conduct C-TPRM more easily by synthesizing the publicly available information without requiring any involvement of the subject organization. In this study, the existing methods for C-TPRM built by different companies are presented and compared to discover the commonly used indicators and criteria for the assessments. Additionally, the results of different methods assessing the cybersecurity risks of a specific organization were compared to examine reliability and consistency. The results showed that even if there is a similarity among the results, the provided security scores do not entirely converge.

中文翻译：

---

网络第三方风险管理：非侵入式风险评分报告的比较

在这个时代，网络安全是组织关注的问题。但是，增强组织内部网络的安全性可能还不够，因为现代组织依赖第三方，而这些依赖性可能会为网络罪犯开辟新的攻击途径。网络第三方风险管理（C-TPRM）在商业世界中是一个相对较新的概念。所有供应商或合作伙伴都具有潜在的安全漏洞和威胁。即使组织拥有最佳的网络安全实践，其数据，客户和声誉也可能由于第三方而受到威胁。组织寻求有效和高效的方法来评估合作伙伴的网络安全风险。除了评估组织的网络安全风险的侵入性方法（例如渗透测试）之外，通过合成公开可用的信息而无需主题组织的任何参与，非侵入性方法正在涌现，从而可以更轻松地进行C-TPRM。在这项研究中，提出并比较了不同公司建立的C-TPRM的现有方法，以发现常用的评估指标和标准。此外，还比较了评估特定组织的网络安全风险的不同方法的结果，以检验可靠性和一致性。结果表明，即使结果之间存在相似性，所提供的安全评分也不会完全收敛。介绍并比较了不同公司建立的C-TPRM的现有方法，以发现常用的评估指标和标准。此外，还比较了评估特定组织的网络安全风险的不同方法的结果，以检验可靠性和一致性。结果表明，即使结果之间存在相似性，所提供的安全评分也不会完全收敛。介绍并比较了不同公司建立的C-TPRM的现有方法，以发现常用的评估指标和标准。此外，还比较了评估特定组织的网络安全风险的不同方法的结果，以检验可靠性和一致性。结果表明，即使结果之间存在相似性，所提供的安全评分也不会完全收敛。