Third-Party Risk Management: A Complete Enterprise Guide

Third party risk management is the discipline of finding, assessing, contracting for, monitoring and exiting the vendors, suppliers, partners and service providers that touch your data, systems or operations.

It matters because attackers increasingly go through the supplier instead of the front door: Verizon's 2026 Data Breach Investigations Report, as reported by Expert Insights, found that 48% of confirmed breaches involved a third party, up from 30% in the prior dataset. This guide walks through the full program: scope and vocabulary, risk types, regulations, the vendor lifecycle, tiering, due diligence, contracts, continuous monitoring, real incidents, and a tested scoring script you can adapt.

A third party is any external organization that provides a product or service to you, processes or stores your data, connects to your network, or acts on your behalf. That includes software vendors, cloud and SaaS providers, managed service providers, payment processors, contractors, consultants, law and accounting firms, and open-source maintainers whose code you ship. Third-party risk management, often shortened to TPRM, is the program that keeps the resulting risk within your appetite.

• Breaches increasingly run through suppliers. The 2026 DBIR, as reported by Expert Insights, puts third-party involvement at 48% of confirmed breaches, after the figure had already doubled between the 2024 and 2025 reports. The dataset covers more than 22,000 breaches across 145 countries.
• Vendors fix basic gaps slowly. The same coverage reports that only 23% of third-party organizations fully fixed missing or misconfigured MFA on cloud accounts, and that half of MFA findings were closed within a month while weak-password and excessive-permission findings took nearly eight months to reach the halfway point.
• One supplier can fail many customers at once. A software update, a file-transfer product or a shared cloud platform can turn one vendor event into thousands of customer incidents. See the case studies in section 9.
• Regulators now name the vendor. The EU's DORA has applied to financial entities since January 17, 2025 and requires a register of ICT third-party contracts, contract terms and exit plans. NIS2 and sector rules add supply-chain duties.
• Attackers read your vendor list too. Support desks, managed service providers and integrations hold privileged access that bypasses your perimeter. Compare insider-style abuse of trusted access in Insider Threat Detection.

Verizon describes third-party exposure through three archetypes: a vendor in your software supply chain, a vendor that hosts your data, and a vendor connected into your environment. Each fails differently, so each needs different questions.

You do not need to invent a program. Choose a framework as the backbone, then map regulatory obligations onto it. The table summarizes widely used sources; details change, so verify against the current text.

Run every relationship through the same lifecycle, with the depth of each step set by the vendor's tier.

You cannot manage vendors you cannot list. Start from accounts payable and procurement data, then add single sign-on application lists, cloud and SaaS discovery, network and API logs, and a survey of business owners. Expect surprises: shadow IT and free tools with real data are common. For each vendor record the business owner, services, data types, access type, hosting location, subprocessors, contract dates and an internal risk owner.

Tiering decides where scarce assessment time goes. Score each vendor on a few factors before looking at its controls:

Due diligence asks whether the vendor's controls are good enough for the risk it creates. Match the depth to the tier and ask for evidence, not just answers.

• No MFA on administrator, support or API access to your data
• Refusal to share scope of a certificate or to answer subprocessor questions
• Customer data in production used for testing or AI training without a written basis
• No documented incident notification process or no named security contact
• Findings open for long periods with no owner, mirroring the slow remediation described in the DBIR coverage

The contract is where findings become enforceable. Work with legal and procurement to standardize a security addendum, and scale it to the tier.

Where DORA applies, contract terms are prescribed in more detail, including service descriptions, data locations, audit and access rights and exit strategies. Check the regulation and your supervisor's guidance rather than copying a generic template.

An annual questionnaire is a snapshot taken from far away. Add signals between reviews: external posture changes, new public vulnerabilities in the vendor's products, breach news, financial or ownership changes, expired certificates, and the vendor's own attestation updates. Define trigger events that force an out-of-cycle review, such as a reported breach, a major outage, an acquisition, or a new data type in scope.

Ask Tier 1 and Tier 2 vendors for their critical subprocessors, then map shared dependencies. If five of your nine hosted vendors run on the same cloud platform, a platform outage is a multi-vendor event even though each contract looks independent. The example script in section 10 shows a simple concentration count.

Most programs are weak at the end of the relationship. At termination, revoke accounts and API keys, remove network paths, collect or delete data with written certification, confirm backups and subprocessors are covered, and transfer the service without a gap. For critical vendors, write and test an exit plan before you need it.

These widely reported incidents show different failure modes. Figures are public estimates and details evolved after first reports, so treat them as approximate.

The script scores inherent risk from four factors, assigns a tier, reduces risk by an evidence-based control score to get residual risk, and flags overdue reviews, missing MFA on higher tiers and concentration on a shared hosting provider. The vendors are fictional and the weights are illustrative; replace the list with your inventory export. The output below is the real output of the code.

# tprm_tiering.py: tier vendors by inherent risk, adjust by control evidence, flag gaps.
# Synthetic vendors for illustration. Standard library only.
from datetime import date
from collections import Counter

TODAY = date(2026, 11, 1)
# Weights for inherent risk (each factor rated 1 low .. 5 high)
WEIGHTS = {"data": 0.30, "access": 0.25, "criticality": 0.30, "substitutability": 0.15}
TIER_CUTOFFS = [(4.0, "Tier 1"), (3.0, "Tier 2"), (2.0, "Tier 3")]   # else Tier 4
REVIEW_MONTHS = {"Tier 1": 12, "Tier 2": 12, "Tier 3": 24, "Tier 4": 36}

# name, data, access, criticality, substitutability(5 = hard to replace), control score 0-100,
# last assessed, MFA enforced on access to our data, hosting provider (fourth party)
VENDORS = [
    ("PayrollCo",      5, 3, 5, 4, 82, date(2026, 3, 10), True,  "CloudA"),
    ("CRM-SaaS",       4, 4, 4, 3, 74, date(2025, 8, 2),  True,  "CloudA"),
    ("MSP-Helpdesk",   3, 5, 4, 3, 58, date(2025, 6, 20), False, "CloudB"),
    ("EmailGateway",   3, 4, 4, 2, 88, date(2026, 5, 14), True,  "CloudA"),
    ("BIAnalytics",    4, 2, 3, 2, 69, date(2025, 2, 11), True,  "CloudB"),
    ("MarketingTool",  3, 2, 2, 1, 61, date(2024, 9, 5),  False, "CloudA"),
    ("OfficeCatering", 1, 1, 1, 1, 0,  None,              False, "None"),
    ("LegalDocs",      5, 2, 3, 2, 79, date(2026, 1, 22), True,  "CloudC"),
    ("FileTransfer",   4, 4, 3, 2, 55, date(2025, 4, 3),  False, "CloudB"),
    ("TrainingPortal", 2, 2, 1, 1, 70, date(2025, 10, 1), True,  "CloudA"),
]

def inherent(d, a, c, s):
    return WEIGHTS["data"] * d + WEIGHTS["access"] * a + WEIGHTS["criticality"] * c + WEIGHTS["substitutability"] * s

def tier(score):
    return next((t for cut, t in TIER_CUTOFFS if score >= cut), "Tier 4")

def months_since(d):
    return 999 if d is None else (TODAY.year - d.year) * 12 + TODAY.month - d.month

def residual(inh, ctrl):
    """Inherent risk reduced by evidenced controls; a 100-point control score removes 60% of it."""
    return inh * (1 - 0.6 * ctrl / 100)

if __name__ == "__main__":
    rows = []
    for n, d, a, c, s, ctrl, last, mfa, host in VENDORS:
        inh = inherent(d, a, c, s)
        t = tier(inh)
        due = months_since(last) > REVIEW_MONTHS[t] and not (last is None and t == "Tier 4")
        rows.append((n, inh, t, ctrl, residual(inh, ctrl), due, mfa, host))
    rows.sort(key=lambda r: -r[4])
    print(f"{'Vendor':15}{'Inherent':>9} {'Tier':7}{'Controls':>9}{'Residual':>9}  Flags")
    for n, inh, t, ctrl, res, due, mfa, host in rows:
        flags = []
        if due: flags.append("REVIEW OVERDUE")
        if t in ("Tier 1", "Tier 2") and not mfa: flags.append("NO MFA")
        print(f"{n:15}{inh:9.2f} {t:7}{ctrl:9}{res:9.2f}  {', '.join(flags) or '-'}")
    hosts = Counter(r[7] for r in rows if r[7] != "None")
    top, cnt = hosts.most_common(1)[0]
    share = 100 * cnt / sum(hosts.values())
    print(f"\nConcentration: {cnt} of {sum(hosts.values())} hosted vendors depend on {top} ({share:.0f}%)")
    t12 = [r for r in rows if r[2] in ("Tier 1", "Tier 2")]
    cov = 100 * sum(1 for r in t12 if not r[5]) / len(t12)
    print(f"Tier 1-2 vendors assessed on schedule: {cov:.0f}%")

Output:

Vendor          Inherent Tier    Controls Residual  Flags
MSP-Helpdesk        3.80 Tier 2        58     2.48  REVIEW OVERDUE, NO MFA
FileTransfer        3.40 Tier 2        55     2.28  REVIEW OVERDUE, NO MFA
PayrollCo           4.35 Tier 1        82     2.21  -
CRM-SaaS            3.85 Tier 2        74     2.14  REVIEW OVERDUE
BIAnalytics         2.90 Tier 3        69     1.70  -
LegalDocs           3.20 Tier 2        79     1.68  -
EmailGateway        3.40 Tier 2        88     1.60  -
MarketingTool       2.15 Tier 3        61     1.36  REVIEW OVERDUE
OfficeCatering      1.00 Tier 4         0     1.00  -
TrainingPortal      1.55 Tier 4        70     0.90  -

Concentration: 5 of 9 hosted vendors depend on CloudA (56%)
Tier 1-2 vendors assessed on schedule: 50%

Read the result the way a reviewer would: the managed helpdesk and file-transfer vendors rank highest on residual risk because they combine high access with weak evidence, and both lack MFA. The vendor with the biggest inherent score, PayrollCo, ranks third because its controls are well evidenced. Half of the higher-tier vendors are overdue, and over half of hosted vendors share one platform. Those three findings are exactly what a board summary should say.

Put the top few on your executive dashboard alongside the measures in Cybersecurity Metrics: KPIs Every CISO Should Track, and tie vendor remediation work into the budget case from Corporate Cybersecurity Budget Planning.