Pepper Money Case Study
Industry: Banking and Finance
Pepper Money implemented MyCISO Suppliers to transform manual, one-size-fits-all supplier assessments into a scalable, risk-based third-party risk management program across approximately 750 suppliers.
Challenge
Pepper Money faced three interconnected challenges in managing third-party risk as their supplier ecosystem grew.
- Supplier security assessments relied heavily on manual questionnaires, creating bottlenecks during onboarding and periodic review cycles
- Suppliers were assessed using a largely uniform approach regardless of their criticality or level of access to sensitive data
- Difficult to prioritise assurance efforts with limited resources across a growing portfolio of suppliers
Solution
Pepper implemented MyCISO Suppliers to establish a structured, scalable, and risk-based approach to third-party risk management.
- Standardised security questionnaires aligned to Pepper's risk expectations with automated evidence collection
- Clear differentiation of suppliers based on criticality, exposure, and business impact
- Higher-risk suppliers with access to sensitive data were subject to deeper assessment
Outcome
Supplier assessment effort was significantly reduced, with review time decreasing from up to an hour per supplier to just minutes.
- Review time per supplier reduced from up to an hour to minutes through automated workflows
- Risk differentiation based on criticality and exposure improved decision-making
- A practical and sustainable foundation for third-party risk management supporting regulatory expectations
Managing supplier risk at scale requires more than questionnaires. MyCISO helped us structure our supplier assurance around real exposure and criticality, which significantly reduced manual effort and improved visibility.
Brijesh Modi, Security Manager, Pepper Money