Security & governance
Third-party risk management (TPRM)
Third-party risk management (TPRM) is the process an organization uses to identify, assess and control the risks that come from relying on outside suppliers. It covers the whole relationship, from selecting a supplier to leaving one, and applies with particular force to suppliers that hold the organization's data or run services it cannot operate without.
What does the TPRM lifecycle look like?
TPRM is continuous. Each stage produces evidence that regulators and auditors may ask to see.
| Stage | What happens |
|---|---|
| Inventory and tiering | Suppliers listed and ranked by how critical they are |
| Due diligence | Security, financial and legal review before contract |
| Contracting | Audit rights, security terms, data processing agreement, exit terms |
| Ongoing monitoring | Assurance reports, incidents, performance against service levels |
| Concentration review | Dependence on one supplier or region across the estate |
| Exit | Tested plan to move data and service elsewhere |
Which risks do storage providers raise?
A supplier that stores data carries several distinct risks. Confidentiality: who at the supplier, and at its sub-processors, can reach the data. Availability: what happens to the organization if the service is down for a day or a week. Jurisdiction: which governments can compel the supplier, covered under extraterritorial data access. Durability: how the supplier protects against loss. And exit: how long and how costly it would be to leave, the subject of vendor lock-in.
What evidence is used?
Due diligence leans on independent assurance, since customers can rarely audit a large provider directly. A SOC report or an ISO 27001 certificate describes the supplier's controls and whether an auditor found them operating. Questionnaires, penetration test summaries and incident history fill in the picture. The limits of such evidence should be read carefully: a report covers a defined scope and period, and controls the customer must operate itself are listed separately.
How is regulation shaping TPRM?
Financial regulators have led the way. The EU's Digital Operational Resilience Act, in application since January 2025, requires financial entities to keep a register of ICT suppliers, include specific contract terms and maintain exit strategies for critical functions. Comparable expectations exist in other sectors and countries. One effect is renewed interest in reducing third-party dependence where it is practical: data held on infrastructure the organization operates falls under its own controls and outside the supplier register for that function. Cloud exit planning covers the exit side.
Frequently asked questions
Is TPRM only for regulated industries?
No. Regulation makes it mandatory in some sectors, but any organization that depends on suppliers for critical services faces the same risks.
Does a SOC 2 report mean a supplier is secure?
It means an auditor examined specified controls over a period. It is evidence to weigh, with attention to scope and exceptions.
What is fourth-party risk?
Risk from the supplier's own suppliers, such as the cloud platform a software provider runs on.
Related terms
- Data processing agreement (DPA): the privacy contract with a supplier.
- SOC report: independent assurance on supplier controls.
- Vendor lock-in: the exit risk TPRM has to plan for.
- Extraterritorial data access: the jurisdiction risk of a supplier.
- Data controller vs. data processor: who stays accountable when a supplier is used.