Third-Party Risk Management

What is third-party risk management?

Almost every organisation depends on others: cloud platforms, software vendors, payment processors, outsourced IT, consultants and the open-source code inside its products. Each can expose your data or disrupt your services. Third-party risk management (TPRM) is how you find those dependencies, judge the risk each brings, and manage it for as long as the relationship lasts.

In cybersecurity it is often called supply chain risk management, especially when it covers the software and hardware you build on, not only the services you buy.

How does the lifecycle work?

1. Inventory and tiering. List your third parties and sort them by risk, based on what data they hold, what access they have and how critical their service is. A payroll provider holding staff data needs more scrutiny than a catering supplier.
2. Due diligence before signing. Proportionate to the tier: a short questionnaire for low-risk suppliers, and for high-risk ones independent evidence such as a SOC 2 report, an ISO/IEC 27001 certificate or a CSA STAR entry, plus your own review.
3. Contracts. Security requirements, the right to audit or receive reports, breach notification deadlines, rules on subcontractors, data location and return or deletion at the end.
4. Ongoing monitoring. Annual reviews of evidence, tracking the supplier’s incidents and changes, and watching for problems such as an exploited flaw in a product you use.
5. Exit. Plans to move away from a critical supplier if you have to, and confirmation that your data is returned or destroyed.

What do the frameworks say?

• NIST CSF 2.0 made cybersecurity supply chain risk management a category under its new Govern function, signalling that it is a leadership responsibility, not just a procurement task.
• NIST SP 800-161 Revision 1, updated in November 2024, is NIST’s detailed guide. It covers strategy, policies and plans, and risk assessments for the products and services an organisation buys.
• ISO/IEC 27001 includes controls on information security in supplier relationships, supplier agreements, the ICT supply chain, monitoring suppliers and using cloud services.

What does the law require?

• The EU’s DORA sets detailed rules for financial entities’ ICT third-party risk, including a register of information on all ICT third-party contracts, required contract terms, exit strategies and direct EU oversight of critical ICT providers.
• NIS2 lists supply chain security among the cybersecurity risk-management measures essential and important entities must take, including the security of relationships with direct suppliers and service providers.
• Data protection law, such as GDPR, requires contracts with processors and makes the controller answerable for choosing processors that protect personal data.

Common pitfalls

Sending the same long questionnaire to every supplier, collecting reports nobody reads, not checking which systems a SOC 2 report actually covers, forgetting fourth parties (your suppliers’ suppliers), and treating due diligence as a one-off at onboarding. Focus effort on the few suppliers that could really hurt you.