Third-party risk management (TPRM)

Third-party risk management (TPRM) is the systematic identification, assessment and monitoring of the risks a company faces from third parties: suppliers, IT and cloud service providers, software vendors and partners. In information security the central question is which third parties have access to data, systems or processes, and what happens if one of them is compromised. TPRM covers the entire business relationship, from selection to termination.

Why third-party risk management matters

An attacker does not have to get past the best-protected company, only past the weakest link that has access. A compromised IT service provider with remote maintenance access, a hosting provider holding customer data or a supplier whose systems stand still after a ransomware attack hits your own company directly. Regulation adds to this: NIS2 requires supply chain security measures, DORA requires management of ICT third-party risk. Without knowing which third parties are critical and how secure they are, you can neither manage nor demonstrate either.

How third-party risk management works

A TPRM programme usually follows the life cycle of a supplier relationship:

• Inventory and tiering: record all third parties and classify them by criticality, for example by whether they access data or systems or whether their failure stops operations.
• Due diligence before contract: questionnaires, certificates such as ISO 27001, audit reports and conversations establish how secure the third party is.
• Contract: set security requirements, incident notification duties, audit rights and exit rules.
• Ongoing monitoring: detect changes instead of relying on the check at contract signature, for example with security ratings, incident reports and regular reassessment.
• Termination: revoke access, have data returned or deleted, secure the transition.

The more critical a third party, the more thorough the due diligence and the closer the monitoring.

How blacklens.io supports third-party risk management

blacklens.io covers ongoing monitoring from the outside. In Supply Chain Monitoring you add suppliers one by one or by CSV import and give each a criticality (Low, Medium, High, Critical). Every supplier is rated from the outside, with nothing to install or approve on its side, and re-rated every 7 days: with a grade from A to F, a score from 0 to 100 and findings with remediation guidance across nine rating areas. When a rating is worse than the last one, the alert "Supplier risk increased" reports it by email, push or integration, with high severity for suppliers marked Critical. The ransomware watchlist checks about every 30 minutes whether a supplier appears on a leak site.

The Supplier Report per supplier and the scheduled Supply Chain Report for the whole portfolio provide dated evidence for NIS2 and DORA. blacklens.io does not cover questionnaires, self-assessments or contract review; they remain part of your TPRM process.

What is the difference between TPRM and vendor risk management?

The terms are often used interchangeably. Vendor risk management, in the narrower sense, covers suppliers and service providers under contract. Third-party risk management is broader and includes all third parties, such as distribution partners, subsidiaries and your suppliers' subcontractors. In information security both come down to the same question: which third parties can put your security at risk?

Do NIS2 and DORA require third-party risk management?

In substance yes, without prescribing a specific method. NIS2 lists supply chain security as a measure in Article 21(2)(d) and, under Article 21(3), requires entities to take into account the vulnerabilities specific to each direct supplier and the quality of its cybersecurity practices. DORA governs financial entities' ICT third-party risk in Articles 28 to 30 and requires, among other things, a register of information on all contractual arrangements with ICT third-party service providers (Article 28(3)).

Which suppliers should be monitored first?

Those that would cause the most damage in an incident: service providers with access to your systems, for example for remote maintenance or managed services, providers that process personal or confidential data, and suppliers without whom operations stop. A simple classification by data access, system access and replaceability is enough to start. Check critical third parties thoroughly before signing and monitor them continuously; a lighter check is enough for non-critical ones.