What is third-party risk management?

What is third-party risk management?

Third-party risk management (TPRM), also called vendor risk management, is the ongoing program an organization runs to control the risks that come from outside parties: suppliers, SaaS and cloud providers, managed service providers, contractors, business partners and the subcontractors they rely on. Outsourcing moves the work to someone else, but the accountability stays with the organization whose customers, data and operations are affected. Regulators, courts and customers judge it on whether it chose, contracted with and supervised its vendors responsibly.

The vendor life cycle

1. Intake and tiering: the business owner describes the service, the data involved and any network or privileged access, and the vendor is assigned a risk tier.
2. Due diligence: the vendor's security, finances and history are checked at a depth that matches its tier.
3. Contracting: security requirements become obligations in the MSA, SLA, data processing agreement and similar documents, including breach notification deadlines, audit rights and data return at exit.
4. Onboarding: vendor accounts and connections are set up with least privilege, MFA, expiry dates and network segmentation.
5. Monitoring: periodic reassessments, fresh audit reports, service-level tracking, and extra reviews after a vendor breach, an acquisition or a change in the data shared.
6. Offboarding: access is revoked, shared credentials and keys are rotated, and the vendor confirms in writing that data was returned or destroyed.

The vendor registry and fourth parties

A TPRM program depends on a complete vendor registry that records each vendor's internal owner, tier, data types, access paths, contract dates and latest evidence. Without it, a team cannot answer the first question after a vendor breach or a widely exploited vulnerability: which of our suppliers are affected, and what do they hold? Matching purchasing and expense records against the registry also uncovers shadow IT. The registry should list fourth parties as well, meaning the vendor's own suppliers such as its cloud host, because a failure at any link in that chain can expose the original organization's data.

Example: a contractor's credentials

The 2013 Target breach is the classic case. Attackers first stole network credentials from a refrigeration and HVAC contractor that used Target's systems for billing and project work. From that foothold they moved deeper into the retailer's network and installed malware on point-of-sale systems, taking about 40 million payment card numbers. Several TPRM controls could have broken the chain: limiting the contractor to the one portal it needed, isolating vendor access from the payment environment, requiring MFA for vendor logins and watching how vendor accounts were used.

Standards that require vendor oversight

• PCI DSS v4.0.1 Requirement 12.8 calls for a list of third-party service providers, written agreements, a due diligence process before engagement, and a check of each provider's compliance status at least once every 12 months.
• GDPR Article 28 requires controllers to choose processors that can show adequate security measures, and to bind them with a contract containing specific terms.
• NIST CSF 2.0 puts cybersecurity supply chain risk management in its Govern function, as the category GV.SC.
• The EU's Digital Operational Resilience Act (DORA) requires financial entities to manage ICT third-party risk and keep a register of their ICT service contracts.

TPRM vs. supply chain attack vs. supply chain risk management

A supply chain attack is the threat: an adversary compromises a trusted supplier, product or update to reach that supplier's customers. TPRM is one of the main defenses, focused on the relationships an organization has with the companies it buys from and shares data with. Cybersecurity supply chain risk management (C-SCRM), described in NIST SP 800-161, is broader and reaches into the products themselves: where hardware and software components come from, whether they are genuine, and what a software bill of materials reveals about their dependencies. In practice the programs overlap, and many organizations run them together.

Third-party risk management on the CompTIA Security+ exam

SY0-801 covers third-party risk under objective 5.3, which deals with assessing and managing the risk of vendors and partners. Expect scenarios built around one stage of the life cycle: choosing a vendor (due diligence, RFI, RFP or RFQ), contracting (MSA, SOW, SLA, MOU, MOA, NDA), monitoring (right-to-audit clauses, vendor assessments, attestations, penetration testing with the vendor's written permission) or exit, along with vendor lock-in and the practical limits on how much a team can verify. A question about knowing which vendors hold a given kind of data points to the vendor registry, and one about confirming a vendor's controls over time points to independent evidence such as a current audit report. Supply chain attack is the usual distractor when the question asks for a management process rather than an attack name.