Third-party risk management (TPRM) is the process of identifying, assessing and controlling the risks that vendors, suppliers, SaaS providers and partners introduce to your organization. Because many breaches start at a supplier, frameworks such as SOC 2, ISO 27001, HIPAA and NIST CSF 2.0 expect a structured vendor risk program. A practical TPRM program inventories vendors, tiers them by risk, performs proportionate due diligence, sets contractual controls and monitors vendors over time.
Key Takeaways
- Not all vendors need the same scrutiny; tier them by data access and business criticality.
- Due diligence should be proportionate: light for low-risk, deeper for critical vendors.
- Contracts must include security, breach notification and audit rights.
- Continuous monitoring catches changes between annual reviews.
- Offboarding vendors safely is part of the lifecycle.
The 7-Step TPRM Program
1. Build a vendor inventory
Collect vendors from finance, procurement and IT. Include SaaS apps discovered through single sign-on and cloud app discovery tools.
2. Tier vendors by risk
| Tier | Criteria | Assessment depth |
|---|---|---|
| Critical | Access to sensitive data or core operations | Full questionnaire, SOC 2/ISO evidence, review meeting |
| High | Access to internal data or systems | Standard questionnaire and evidence |
| Medium | Limited data, replaceable | Short questionnaire |
| Low | No data access | Basic checks |
3. Perform due diligence
Request SOC 2 reports, ISO 27001 certificates, penetration test summaries, policies and insurance details. Use standardized questionnaires where possible.
4. Assess and decide
Rate residual risk, document required remediation, and approve, approve with conditions, or reject.
5. Contract for security
- Data protection and confidentiality clauses.
- Breach notification timelines.
- Right to audit or receive assurance reports.
- Subprocessor disclosure.
- Data return and deletion at termination.
6. Monitor continuously
Track renewals of assurance reports, security news, breach disclosures and changes in data scope. Reassess critical vendors at least annually.
7. Offboard safely
Revoke access, rotate shared credentials, and confirm data return or deletion.
Common TPRM Mistakes
- Sending the same long questionnaire to every vendor.
- Collecting SOC 2 reports without reading exceptions and complementary user entity controls.
- Ignoring shadow IT and free SaaS tools.
- No owner for each vendor relationship.
Third-Party Risk and AI Vendors
AI tools add new questions about training on your data, retention and model risk. Review AI vendors with the same rigor, as covered in our guides on shadow AI and ISO 42001 vs NIST AI RMF.
Being assessed yourself? See SOC 2 Type 1 vs Type 2.
How Skytech Enterprise Helps
Our third-party risk management service builds vendor inventories, tiering models and assessment workflows, supported by virtual CISO oversight. Talk to us.
Frequently Asked Questions
What is third-party risk management?
It is the process of identifying, assessing, mitigating and monitoring risks from vendors, suppliers and partners that access your data or support your operations.
How often should vendors be reassessed?
Critical vendors at least annually, with continuous monitoring; lower tiers less frequently or at renewal.
Is a SOC 2 report enough for vendor due diligence?
It is strong evidence, but you should review its scope, exceptions and complementary user entity controls, and check it covers the services you use.
Who owns third-party risk?
Typically a shared model: procurement manages the process, security assesses risk, legal handles contracts and business owners own the relationship.
Do small companies need TPRM?
Yes. A lightweight program with tiering and contract controls is achievable for small organizations and is often required by customers.
What is fourth-party risk?
Fourth-party risk comes from your vendors’ own suppliers and subprocessors, which can affect your data indirectly.