Category: Third-Party & Supply Chain Risk

Third-Party Risk Management

Also known as: TPRM, Third-Party Risk Management (TPRM), vendor risk management

Simply put

Third-Party Risk Management (TPRM) is the practice of identifying and reducing the risks that arise when an organization relies on outside parties, such as vendors or service providers, to perform business functions. It involves assessing and monitoring those third parties over time to understand and control the cybersecurity and compliance risks they may introduce. The goal is not to eliminate the use of third parties, but to manage the risks associated with them.

Formal definition

Third-Party Risk Management (TPRM) is a continuous discipline within an organization's broader risk management program focused on identifying, assessing, monitoring, and mitigating risks arising from the use of third parties, including risks introduced by outsourcing business functions. It typically encompasses cybersecurity and compliance risk dimensions across the third-party lifecycle. TPRM is often implemented through a framework, defined as a structured set of controls, processes, and governance requirements that organizations use to identify and manage these risks in a repeatable way. In practice, the effectiveness of a TPRM program depends on organizational maturity, defined scope, and ongoing monitoring rather than one-time assessment; accountability for third-party risk decisions generally remains with the client organization and its officers.

Why it matters

Modern organizations rarely operate in isolation. They depend on vendors, cloud providers, contractors, and other service providers to perform critical business functions, and each of those relationships can introduce cybersecurity and compliance risk that the organization does not directly control. When a third party has access to sensitive data, systems, or infrastructure, a weakness on their side can become an exposure for the organization that engaged them. TPRM matters because the risk associated with outsourcing does not transfer along with the function; accountability for the decision to rely on a third party generally remains with the client organization and its officers.

Because third-party relationships change over time, a one-time assessment during vendor selection is rarely sufficient. Vendors add new services, change subprocessors, experience their own security incidents, or drift out of compliance, and risks that were acceptable at onboarding may not remain so. This is why TPRM is best understood as a continuous discipline of identifying, assessing, monitoring, and mitigating risk across the third-party lifecycle rather than a procurement checkbox. Programs that treat it as a static exercise tend to miss the risks that emerge after a contract is signed.

A common expert correction is worth stating plainly: TPRM is not purely a technical or procurement task, and it is not the same as offloading responsibility to the vendor. It is a governance and business risk function. Its effectiveness depends heavily on organizational maturity, clearly defined scope, and sustained monitoring. A program with strong questionnaires but no ongoing review, or with no clear owner for risk decisions, will struggle to reduce actual exposure regardless of how much documentation it produces.

Who it's relevant to

Security and risk leaders

CISOs, security directors, and risk officers own the strategy for how third-party risk is identified, prioritized, and governed. They are responsible for ensuring TPRM operates as a continuous discipline tied to the organization's broader risk program, and for making the risk-acceptance decisions that ultimately remain with the organization's officers.

Organizations engaging a virtual or fractional CISO

Companies that rely on a vCISO or fractional CISO often look to that leader to design or mature a TPRM framework, establish repeatable assessment and monitoring processes, and advise on vendor risk decisions. It is important to note that a virtual CISO typically directs and advises on the program at the governance level; hands-on operational tasks such as continuous vendor monitoring tooling are generally out of scope unless explicitly contracted, and accountability for the decisions stays with the client.

Procurement and vendor management teams

These teams often serve as the entry point for new third-party relationships and are well positioned to ensure risk assessment is built into onboarding rather than treated as an afterthought. Effective TPRM requires that procurement and security coordinate, since procurement decisions carry cybersecurity and compliance implications that persist for the life of the vendor relationship.

Compliance and governance stakeholders

Compliance officers and governance functions rely on TPRM to understand and manage the compliance risks introduced by outsourcing. They should recognize that a TPRM program supports readiness and ongoing risk management but does not by itself assert or guarantee compliance with any given standard or regulation.

Executive leadership and boards

Because accountability for third-party risk decisions rests with the organization and its officers, executives and boards have a direct stake in how TPRM is scoped, resourced, and sustained. Understanding third-party risk as a business and governance concern, rather than a purely technical one, helps leadership allocate the maturity and stakeholder cooperation the program depends on.

Inside TPRM

Vendor Inventory and Classification

A maintained record of third parties with access to systems, data, or critical functions, typically tiered by the level of risk each vendor introduces. Classification informs the depth of due diligence and ongoing oversight applied to each relationship.

Due Diligence and Assessment

Evaluation of a vendor's security posture before and during engagement, often through questionnaires, evidence review, and mapping against frameworks such as SOC 2, ISO 27001, or NIST CSF. This supports risk understanding but does not by itself guarantee a vendor's security.

Contractual and Legal Controls

Provisions such as security requirements, data protection clauses, breach notification obligations, audit rights, and defined liability. These clarify where accountability sits and typically remain the responsibility of the client organization and its legal counsel to negotiate and enforce.

Ongoing Monitoring

Continuous or periodic review of vendor risk over the lifecycle of the relationship, which may include reassessments, external risk signals, and tracking of remediation. Point-in-time assessments alone are often insufficient as vendor risk changes over time.

Risk Governance and Reporting

The governance structure that defines ownership, escalation paths, risk acceptance decisions, and executive reporting for third-party risk. A virtual CISO commonly advises on and helps direct this structure while accountability generally remains with client officers.

Offboarding and Termination

Processes for revoking access, confirming data return or destruction, and closing out obligations when a vendor relationship ends. This is frequently overlooked but is important to reduce residual exposure.

Common questions

Answers to the questions practitioners most commonly ask about TPRM.

Does a virtual CISO run the day-to-day third-party risk management program?

Typically no. A virtual CISO usually establishes the TPRM strategy, governance model, risk criteria, and processes, and advises on how vendors should be assessed and tiered. The ongoing operational work, sending assessment questionnaires, collecting evidence, tracking remediation, and maintaining vendor records, is generally handled by internal staff or a dedicated tool, unless hands-on execution is explicitly contracted. It is a common mistake to assume the vCISO personally performs each vendor review; their role is more often to direct and oversee the program rather than operate it. This division can vary by provider and engagement scope, so it should be clarified in the agreement.

If a vCISO builds our TPRM program, are they accountable for a breach originating from one of our vendors?

Generally no. A virtual CISO advises on and directs third-party risk practices, but legal and organizational accountability for vendor decisions typically remains with the client organization and its officers. Accepting or rejecting a vendor's residual risk is usually a business decision made by client leadership. Unless a contract specifically assigns liability to the vCISO or provider, the vCISO's role is to help the organization make informed decisions, not to assume accountability for the outcome of a vendor incident. Expectations around accountability should be defined in writing rather than assumed.

How does a vCISO usually help us get a TPRM program started?

In many engagements, a virtual CISO begins by helping inventory existing vendors, defining risk tiers based on factors such as data access and business criticality, and establishing assessment criteria proportionate to each tier. They often align the approach to a chosen framework and help select or recommend supporting tools and workflows. The value of this work frequently depends on organizational maturity, access to relevant stakeholders, and the client's willingness to maintain the program after it is designed. Providers may vary in how much of the initial setup they perform versus advise on.

How should we prioritize vendors when we have too many to assess at once?

A common approach a virtual CISO may recommend is risk-based tiering, where vendors are grouped by the level of risk they present rather than treated uniformly. Factors often considered include the sensitivity of data a vendor can access, whether they connect to internal systems, their role in critical operations, and any regulatory exposure they introduce. Higher-tier vendors typically warrant deeper assessment and more frequent review, while lower-tier vendors may receive lighter scrutiny. The specific tiering model and thresholds may vary by organization and engagement.

Can a vCISO guarantee our vendors are compliant with standards like SOC 2 or ISO 27001?

No. A virtual CISO can help you request and review third-party attestations such as SOC 2 reports or ISO 27001 certificates and interpret what they cover, but they cannot guarantee a vendor's compliance or certification status. These artifacts reflect a point in time and a defined scope, so a vCISO typically advises on how to evaluate their relevance rather than asserting a vendor is fully compliant. Supporting readiness and evaluating evidence is distinct from certifying a third party, and that distinction should be kept clear.

How often should third-party risk assessments be repeated after onboarding?

Reassessment cadence often depends on the vendor's risk tier and the nature of the relationship. In many programs a virtual CISO helps define, higher-risk vendors are reviewed more frequently or when triggering events occur, such as contract renewals, changes in data access, or reported incidents, while lower-risk vendors may be reviewed on a longer cycle. There is no single universal interval, and the appropriate frequency may vary by provider guidance, regulatory expectations, and the resources the client can sustain over time.

Common misconceptions

A one-time vendor assessment means the third party is secure and no longer poses risk.

Assessments are typically point-in-time and reflect conditions at that moment. Vendor risk can change as their environment, ownership, or controls evolve, so ongoing monitoring and periodic reassessment are usually needed.

Outsourcing a function to a vendor transfers the associated risk and accountability to that vendor.

Contractual terms may shift certain obligations, but legal and regulatory accountability for protecting data and meeting compliance requirements generally remains with the client organization and its officers. A virtual CISO can advise on TPRM but does not assume this accountability unless a contract specifies otherwise.

A virtual CISO running TPRM will personally administer the assessment tools and monitor every vendor operationally.

A virtual CISO typically provides strategy, governance, and program direction for TPRM. Hands-on operational tasks such as continuous monitoring tool administration are generally out of scope unless explicitly contracted, and often depend on internal staff or dedicated providers.

Best practices

Build and maintain a vendor inventory, then tier vendors by risk so that due diligence depth is proportionate to the access and criticality of each relationship.

Move beyond point-in-time questionnaires by establishing periodic reassessment cadences and ongoing monitoring appropriate to each vendor's risk tier.

Coordinate with legal and procurement to embed security, breach notification, audit rights, and data protection provisions in contracts, and clarify where accountability sits.

Map vendor assessments to recognized frameworks such as SOC 2, ISO 27001, or NIST CSF to support readiness and consistency, while avoiding treating a vendor attestation as a guarantee of security.

Define clear governance, including risk ownership, acceptance decisions, escalation paths, and executive reporting, recognizing that accountability generally remains with client officers.

Establish offboarding procedures that revoke access and confirm data return or destruction when relationships end, and recognize that program effectiveness depends on stakeholder cooperation and access.