| name | managing-third-party-vendor-risk |
| description | Build and run a third-party/vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM: inventory and tier vendors, issue SIG/CAIQ questionnaires, review SOC 2/ISO 27001 evidence, set contractual right-to-audit clauses, monitor vendors continuously, and offboard securely. Use when assessing a new vendor, standing up a vendor-risk program, tiering a portfolio, reviewing a SOC 2/CAIQ, or writing security terms into a contract. |
| domain | cybersecurity |
| subdomain | compliance-governance |
| tags | ["third-party-risk","vendor-risk-management","tprm","supply-chain-risk","c-scrm","nist-800-161","soc2","caiq","continuous-monitoring","governance"] |
| version | 1.0 |
| author | andrewibrah |
| license | Apache-2.0 |
| nist_csf | ["GV.SC-01","GV.SC-04","GV.SC-06","GV.SC-07","ID.RA-05","GV.OC-03"] |
| mitre_attack | ["T1199","T1195","T1078","T1190","T1567"] |
Managing Third-Party Vendor Risk
When to Use
- When assessing a new vendor before onboarding, especially one that will handle sensitive data, connect to your network, or be embedded in a critical process.
- When standing up or maturing a third-party risk management (TPRM) program and you need a repeatable tiering + assessment workflow.
- When tiering an existing vendor portfolio so effort matches risk.
- When reviewing vendor evidence — a SOC 2 Type II report, ISO 27001 certificate, CAIQ, or pen-test summary — and you need to know what to look for.
- When writing security and privacy requirements into a contract / DPA, including breach-notification SLAs and right-to-audit.
- When a vendor (or their subcontractor) suffers a breach and you must assess exposure.
- When managing software supply-chain and Nth-party (fourth-party and beyond) risk.
Prerequisites
- A vendor inventory (who you use, for what, and what data/access each has).
- A defined risk-tiering model (criteria and thresholds) agreed with the business.
- Access to standardized questionnaires (Shared Assessments SIG, CSA CAIQ) and a way to collect evidence.
- Clarity on your own regulatory obligations that flow down to vendors (e.g., HIPAA BAAs, CMMC flowdown, GDPR processor terms, PCI).
- Stakeholders identified: procurement, legal, security, data owner, and the business sponsor.
Workflow
1. Inventory and classify vendors
Catalog every third party and capture: data sensitivity handled, type of access (network, physical, none), business criticality, and regulatory scope. You cannot manage what you have not inventoried — shadow vendors are a common blind spot.
2. Tier by inherent risk
Score each vendor on inherent-risk factors (data sensitivity, access, criticality, regulatory scope, spend/concentration) and assign a tier (e.g., Critical / High / Moderate / Low). The tier drives how deep the assessment goes and how often you reassess. A payroll processor with PII and system access is not the same risk as a stock-photo subscription.
3. Run tier-appropriate due diligence
- Critical/High: full SIG (or SIG Core), request SOC 2 Type II and/or , recent summary, and evidence of an incident-response capability. Consider an assessor call.
