59% of companies have experienced a third-party breach.

2018 Data Risk in the Third-Party Ecosystem: Third Annual Study

Cost of a Data Breach

Data Breaches can be expensive, to your reputation, to your bottom line, to your compliance profile, to the value of your company. So you do everything you can and should do to secure your data. But 50% of data breaches happen because of circumstances beyond your control – because of errors and omissions made by others – those you do business with, people and businesses who provide valuable products and services that you rely on to succeed in your own business. How can you be certain that those you rely on to do business aren’t introducing vulnerabilities that will cost you?

26%
Reputational
damage

23%
Financial
reporting errors

23%
Regulatory
non-compliance

21%
Breach of
sensitive data

10%
Lost
business

Deloitte survey respondents, damages by third parties.

It takes an average of 197 days to identify a data breach and an average of 70 days to contain it.

2018 Data Risk in the Third-Party Ecosystem: Third Annual Study

Fortress Reduces the Cost of Security & Compliance

To support the needs of commercial clients, Fortress Platform offers a systematic and flexible workflow engine for all major assessment frameworks, including National Institute of Standards & Technology (NIST), ISO 27000, the Cloud Security Alliance (CSA), Star, Software Assurance, etc. To support our DoD clients, the Fortress Platform offers the framework workflows for DoD 8500 series and SECNAV Instruction 5239.3C.

Third Party Risk Management 3

Third-party risk management should be simple.

but sometimes it’s not 🡪

Third Party Risk Management 4

Fortress Brings Simplicity with Comprehensive Risk Management

AUTOMATED INHERENT RISK RANKING

It is important to know which vendors are critical enough to your business to justify spending precious resources on assessments. Automated risk ranking evaluates a vendor’s likely (1) data access, (2) physical access, (3) global footprint, (4) cloud and distributed offerings, (5) reputation-related services and (6) financial health risks.

CONTINUOUS CYBER RISK MONITORING

The externally-visible (i.e., on the web) cyber posture of your vendors is a very good leading indicator of internal cyber hygiene. Fortress Guardian cyber risk monitoring evaluates hundreds of data points summarized into (1) application security, (2) application vulnerabilities, (3) domain name server configuration, (4) secure protocol configuration and certificates, (5) known breaches, (6) dark web activity and (7) compromised assets.

CONTINUOUS OPERATIONAL RISK MONITORING

The third-party risk industry has fragmented solutions for monitoring other, non-cyber risks. Fortress Guardian’s continuous operational risk monitoring includes (1) negative news, social media & sentiment analysis, (2) anti-bribery & anti-money-laundering, (3) legal, (4) financial, (5) safety/OSHA and (6) regulatory & compliance issues.

ANALYTICS, WORKFLOW AND INTEGRATIONS

Fortress believes in connected intelligence and self-service data discovery and has infused rich, industry-leading business intelligence. Workflow is also equipped out of the box to give you real-time updates on assessments and asset information you have requested. Fortress Platform also integrates with all leading GRC, procurement and contract management systems.

Fortress covers 40,000 vendors and 300,000 assets

The Fortress Platform

Fortress Platform is a combination of technology, analytics and services (TAS) that provides seamless integrations to enable advanced threat scenarios and program governance. Value is unlocked from existing tools with machine learning and deep analytics driving prioritization.

Fortress Platform provides the following benefits. Click on each to learn more.

Visibility & Simplicity

FP gives you visibility through a single pane of glass, removing the need for disparate technologies that may not be compatible.

Machine Learning & Human Intelligence

FP uses both machine learning-enabled analytics and human intelligence to drive actionable insights. The objective methods used to aggregate and synthesize data provide greater dependability and reduce reliance on the subjectivity inherent in manual data collection and evaluation.

Blockchain Technology

FP utilizes patented technologies including the validation of the integrity of unique file hashes and public key cryptography using a blockchain distributed ledger – to ensure end-to-end software integrity, transactional assurance and security of cyber-physical assets.

Objective, Reliable & Proactive

FP is enabled by a NERC-onboarded Fortress VSOC team to support machine learning and to provide visibility and also recommendations and tracking for remediation, mitigation, and risk outcomes.

Automated Risk Calculations

FP allows calculation of Risk based on Consequences (Business Impact and Technical Impact) and Likelihood. This includes consideration of threat indicators and implemented controls.

Data Ingestion & Analytics Reporting

Fortress ingests data from multiple sources such as these:

Open Source threat intelligence from our client community
Fortress threat analysis is driven by our Virtual Security Operations Center (VSOC), which supports existing critical infrastructure companies
Other curated threat intelligence

Fortress Secures 10% of the Power Grid and Key Assets

Fortress TPRM Resources

PRESS RELEASE – Hitachi ABB Power Grids joins effort to protect power utilities from cyber threats

Press Release Hitachi abb power grids joins effort to protect power utilities from cyber threats Global leader and pioneer in power technologies will share cybersecurity information with utilities through the Fortress Asset to Vendor Network Raleigh, North...

PRESS RELEASE – Fortress Information Security Adds New Partner In Securing U.S. Power Grid

Press Release Fortress Information Security Adds New Partner In Securing U.S. Power Grid Orlando, FL, June 1, 2020 – The Asset to Vendor Network for Power Utilities (A2V) today announced the group’s first new partner. Founded by Fortress Information Security...

PRESS RELEASE – Security and Compliance Innovator, Tobias Whitney, Joins Fortress Information Security

Press Release Security and Compliance Innovator Joins Fortress Information Security to Develop Groundbreaking Solutions for Utilities, Vendors, and Service Providers Tobias Whitney Joins Orlando-based Security Company Building Solutions for Leading U.S. Energy...

300% faster
program maturity

100% more vendor coverage in the same time period

40 days to
implement

40% effort
reduction

FORTRESS IN THE NEWS

The Cybersecurity 202: Here’s how Biden’s infrastructure package could address electric grid cybersecurity

Mar 31, 2021 | News, Washington Post

President Biden unveiled a $2 trillion-dollar jobs and infrastructure plan today, Jeff Stein, Juliet Eilperin and Michael Laris report. The plan includes at least at least $100 billion for a variety of infrastructure priorities, including...

Northrop Grumman Cyber Report: Cyber Survivability; Exercising w/ The Army

Mar 26, 2021 | News, Podcast

On this week’s Cyber Report, sponsored by Northrop Grumman, Jim Conroy, the vice president of emerging systems and strategic initiatives at Northrop Grumman’s Navigation, Targeting and Survivability Division, discusses securing the military...

As legislators work toward law requiring companies to alert feds to breaches, key hurdles emerge

Mar 12, 2021 | News, SC Media

After two major hearings on Solarigate, one domestic policy proposal grabbed the spotlight: requiring organizations to alert the government to major cyber incidents in the interest of national security. Experts say the idea has merit – if only legislators can balance the promise with the potential liability and burden placed upon industry.