What Is Third-Party Risk Management (TPRM)? Lifecycle, Risk Types and How to Start
CyberRank Research
Third-party risk management (TPRM) is the continuous process of identifying, assessing, monitoring and reducing the risks that come from organisations you rely on but do not control: vendors, suppliers, service providers, contractors and partners. It covers cyber, operational, compliance, financial and reputational risk across the whole relationship, from pre-contract due diligence to offboarding. CyberRank is built for the cyber side of this job: it rates any vendor from AAA to D using public, outside-in signals, combines the rating with your impact tier and reassesses monitored vendors every night.
TL;DR
- TPRM is a lifecycle, not a one-off questionnaire: identify, tier, assess, contract, monitor, offboard.
- Tiering by business impact decides how much effort each vendor gets. A payroll provider and an office-supplies vendor should not receive the same review.
- Cyber risk is the fastest-changing part of third-party risk, so point-in-time reviews need to be paired with ongoing monitoring.
- NIST CSF 2.0 (category GV.SC), NIST SP 800-161r1 and ISO/IEC 27001:2022 controls 5.19–5.23 give you a ready-made structure.
- CyberRank covers the cyber steps of the lifecycle in one platform: an outside-in AAA–D rating from a domain, impact tiers with a risk heat map, fourth-party visibility and nightly reassessment.
What is third-party risk management?
Third-party risk management is the discipline of deciding which outside organisations you can safely depend on, under what conditions, and how you will know when that changes.
A "third party" is any external entity that can affect your confidentiality, integrity, availability or compliance: a cloud host, a payroll processor, a marketing agency with access to your CMS, a logistics partner, a software library maintainer. For a short definition, see our glossary entry on TPRM.
NIST describes the cybersecurity side of this as cybersecurity supply chain risk management (C-SCRM): identifying, assessing and mitigating cybersecurity risks throughout the supply chain at all levels of an organisation (NIST SP 800-161r1). In practice, most enterprise TPRM programmes put cyber risk at the centre because it changes fastest and is hardest to see from contracts and invoices.
That cyber centre is what CyberRank is built around. Instead of waiting for a vendor to fill in a questionnaire, CyberRank rates the vendor from the outside, from its website or company name, so you see its security and privacy posture in minutes.
Why it matters now
Attackers increasingly reach their targets through suppliers rather than attacking them directly, as explained in detail in our article about supply chain attacks. ENISA's analysis of 24 supply chain attacks found that around 62% exploited customers' trust in their supplier, and in about 66% of incidents attackers focused on the supplier's code to compromise the customer (ENISA, Threat Landscape for Supply Chain Attacks, 2021).
Regulation has followed: NIS2 in the EU makes supply chain security an explicit risk-management measure, DORA sets ICT third-party rules for financial entities, and Indonesia's Personal Data Protection Law (UU PDP No. 27/2022) keeps the data controller accountable when a processor handles personal data on its behalf.
Third party vs vendor: what is the difference?
A vendor is a third party that sells you goods or services under contract; "third party" is the wider category that also includes partners, affiliates, contractors, resellers and other external relationships.
Every vendor is a third party, but not every third party is a vendor. For security purposes, the access each relationship has matters more than its label.
CyberRank does not care about the label either: any organisation with a website or company name can be rated, whether it is a contracted supplier, a reseller or a joint-venture partner.
| Aspect | Third-party risk management (TPRM) | Vendor risk management (VRM) |
|---|---|---|
| Scope | Third-party risk management (TPRM)All external relationships: vendors, partners, affiliates, contractors, distributors | Vendor risk management (VRM)Contracted suppliers of products and services |
| Typical owner | Third-party risk management (TPRM)Enterprise risk or security, with legal, compliance and procurement | Vendor risk management (VRM)Procurement with strong security input |
| Risk types | Third-party risk management (TPRM)Cyber, operational, compliance, financial, reputational, strategic, concentration | Vendor risk management (VRM)Mostly cyber, operational, compliance and contract performance |
| Fourth parties | Third-party risk management (TPRM)Tracked when material | Vendor risk management (VRM)Usually via supplier disclosures |
What are the types of third-party risk?
Third-party risk is not one risk. A useful programme names each type, the evidence that tests it and who owns the decision. The last column shows where CyberRank supplies that evidence, and where it does not.
| Risk type | What it looks like | Evidence to request or check | How CyberRank helps |
|---|---|---|---|
| Cybersecurity | What it looks likeExposed vulnerabilities, weak email authentication, leaked credentials, a breach at the vendor | Evidence to request or checkOutside-in assessment, security questionnaire, SOC 2 Type II or ISO/IEC 27001 certificate (check scope), penetration test summary | How CyberRank helpsRates vulnerabilities, email security (DKIM/DMARC), leaked credentials and data breaches from outside, as a Security sub-rating within the AAA–D rating |
| Data protection and privacy | What it looks likePersonal data processed without a lawful basis, weak privacy notice, data stored in a jurisdiction you do not allow | Evidence to request or checkData processing agreement, privacy policy review, hosting and data-residency information | How CyberRank helpsPrivacy sub-rating, privacy-policy review, and hosting and data-residency checks against the jurisdictions you allow |
| Operational | What it looks likeAn outage at a critical provider halts your service | Evidence to request or checkBusiness continuity and disaster recovery plans, SLAs, last test date | How CyberRank helpsCombines your impact tier with breach likelihood, so critical providers with weak posture stand out on the heat map |
| Compliance and regulatory | What it looks likeA vendor's failure puts you in breach of NIS2, DORA, UU PDP or sector rules | Evidence to request or checkContract clauses, audit rights, regulatory attestations | How CyberRank helpsCertificate checks, questionnaires with evidence and expiry dates, reports for auditors and a verifiable Assurance Statement |
| Financial | What it looks likeA key supplier becomes insolvent with your data on its servers | Evidence to request or checkFinancial statements, credit checks, exit plan | How CyberRank helpsNot covered by CyberRank; use financial checks alongside it |
| Concentration and fourth-party | What it looks likeSeveral of your vendors depend on the same cloud, identity or file-transfer provider | Evidence to request or checkSubprocessor lists, dependency mapping, concentration analysis | How CyberRank helpsShows your vendors' own suppliers (fourth parties) with their ratings and combines supply-chain risk across two levels |
What are the six stages of the TPRM lifecycle?
Identify, tier, assess, contract, monitor and offboard. This is how most mature programmes run.
NIST CSF 2.0 expresses the same idea as outcomes: suppliers are known and prioritised by criticality (GV.SC-04), due diligence happens before the relationship starts (GV.SC-06), and risks are monitored over the course of the relationship (GV.SC-07).
| Stage | What happens | Output | Typical owner | How CyberRank helps |
|---|---|---|---|---|
| 1. Identify | What happensBuild an inventory of every third party that touches your data, systems or critical services | OutputVendor register | Typical ownerProcurement + IT | How CyberRank helpsAdd vendors by domain or company name; vendors CyberRank discovers are added only after you confirm them |
| 2. Tier | What happensRate each relationship by business impact and data access | OutputImpact tier (e.g. Critical, High, Medium, Low) | Typical ownerBusiness owner + security | How CyberRank helpsSet an impact tier per vendor; CyberRank turns tier plus breach likelihood into a risk level |
| 3. Assess | What happensDue diligence and risk assessment scaled to the tier: outside-in rating, questionnaire, certificates | OutputRisk rating and findings | Typical ownerSecurity / TPRM team | How CyberRank helpsAAA–D rating in minutes, plus questionnaires with evidence upload |
| 4. Contract | What happensPut security, notification, audit and data-location requirements into the agreement | OutputSigned security schedule | Typical ownerLegal + procurement | How CyberRank helpsBaselines set the minimum rating you accept; vendors below it can be sent a questionnaire automatically |
| 5. Monitor | What happensWatch for changes between reviews: new vulnerabilities, breaches, rating drops, policy changes | OutputAlerts, reassessment triggers | Typical ownerSecurity / TPRM team | How CyberRank helpsNightly reassessment, with events for rating changes, new data breaches and privacy-policy changes |
| 6. Offboard | What happensRevoke access, return or destroy data, close the record | OutputOffboarding checklist | Typical ownerIT + business owner | How CyberRank helpsDone in your own systems; CyberRank is not involved in revoking access |
Why tiering comes before assessment
Tiering decides how deep each assessment goes. Without it, teams either send a 300-question questionnaire to every supplier and drown, or review nothing in depth. A simple model that works:
- Critical: failure directly halts a critical service, or the vendor holds sensitive personal or financial data.
- High: essential, but the impact can be mitigated temporarily.
- Medium: supports normal operations.
- Low: minimal operational impact and no sensitive data access.
How CyberRank applies tiering
CyberRank uses the same model. You give each vendor an impact tier, CyberRank combines it with the vendor's breach likelihood into a risk level, and the heat map puts critical-but-weak vendors at the top of the list. A low rating on a low-impact vendor does not distract you from a mediocre rating on your payroll processor.
Which frameworks guide a TPRM programme?
You do not need to invent a framework. These references are widely used and map to each other.
| Framework | What it gives you | Where it fits |
|---|---|---|
| NIST CSF 2.0, category GV.SC | What it gives youTen supply chain outcomes, from programme and roles (GV.SC-01, -02) to due diligence (GV.SC-06), monitoring (GV.SC-07) and post-contract activities (GV.SC-10) | Where it fitsProgramme structure and board reporting |
| NIST SP 800-161r1 | What it gives youDetailed C-SCRM practices, policy templates and risk assessment guidance | Where it fitsProgramme design and control selection |
| ISO/IEC 27001:2022 Annex A 5.19–5.23 | What it gives youSupplier relationship, agreement, ICT supply chain, monitoring and cloud service controls | Where it fitsCertification and audit evidence |
| OJK IT risk rules for Indonesian banks | What it gives youRisk assessment, contractual safeguards and ongoing oversight of outsourcing providers | Where it fitsBanks and financial institutions in Indonesia |
| CSA Cloud Controls Matrix and CAIQ | What it gives youA standard question set for cloud providers | Where it fitsAssessing SaaS, PaaS and IaaS vendors |
How CyberRank maps to these frameworks
CyberRank's Assurance Statement is built on ISO/IEC 27001:2022 supplier controls 5.21 and 5.22: when every vendor meets your baseline, you can issue a statement that customers, partners and auditors verify by QR code. Its ratings, monitoring history and reports are the supplier evidence that NIST CSF GV.SC and OJK oversight ask for.
How do you start a TPRM programme in 30 days?
Inventory in week 1, tier in week 2, baseline the critical tier in week 3 and set the rules in week 4.
- Week 1, inventory: pull vendor lists from finance (who you pay), IT (who has access or integrations) and the data protection officer (who processes personal data). Merge them into one register.
- Week 2, tier: ask each business owner two questions per vendor: what stops if this vendor fails, and what data do they hold? Assign a tier.
- Week 3, baseline the critical tier: run an outside-in assessment on every Critical and High vendor so you have a first view without waiting for questionnaires. In CyberRank this takes a domain or company name per vendor; you can try it first with our free security rating.
- Week 4, set rules: define a minimum acceptable rating per tier, the reassessment cadence, and what triggers an out-of-cycle review (a breach, a rating drop, a material service change). Choosing the cadence is explained in detail in our article about how often vendors should be reassessed.
Which organisations need third-party risk management most?
Every organisation with suppliers needs it, but regulated sectors and organisations holding sensitive data face the strictest expectations.
- Banks and financial institutions: OJK oversight of IT outsourcing in Indonesia and DORA in the EU. See vendor risk management for banks.
- Hospitals and healthcare providers: health data is among the most sensitive personal data under UU PDP. See vendor risk management for healthcare.
- Government agencies and state-owned enterprises: public services depend on system integrators and cloud providers. See vendor risk management for government and SOEs.
- Publicly listed companies: a vendor incident can quickly become a board-level and disclosure issue. See vendor risk management for listed companies.
What should you look for in a TPRM platform?
Outside-in assessment, impact tiering, fourth-party visibility, monitoring, questionnaires, an explainable scoring method and audit-ready reports. CyberRank was designed to cover all seven in one platform.
| Capability | Why it matters | In CyberRank |
|---|---|---|
| Outside-in assessment from a domain or company name | Why it mattersGives a first view in minutes, independent of vendor self-reporting | In CyberRankAAA–D rating with separate Security and Privacy sub-ratings |
| Impact tiering combined with likelihood | Why it mattersKeeps attention on the vendors that matter, not just the lowest scores | In CyberRankImpact tier × breach likelihood → risk level and heat map |
| Fourth-party visibility | Why it mattersShows risk your direct vendors pass on | In CyberRankFourth parties with their own ratings, combined across two levels |
| Monitoring with change alerts | Why it mattersCatches changes between annual reviews | In CyberRankNightly reassessment; events for rating changes, new breaches and privacy-policy changes |
| Questionnaires with evidence and expiry tracking | Why it mattersCovers controls you cannot see from outside | In CyberRankQuestionnaire builder, evidence upload, expiry dates, automatic sending below your baseline |
| Explainable, published scoring method | Why it mattersLets you defend a decision to auditors and to the vendor | In CyberRankPublished 360-point methodology: observe, rate, score risk, combine |
| Reports for executives and auditors | Why it mattersTurns findings into evidence | In CyberRankManagement Report, Cyber Risk Report, Credential Leak Report and Assurance Statement |
How CyberRank fits
CyberRank is a vendor cyber-risk platform. You enter a vendor's website or company name and CyberRank assesses it from public, outside-in signals, including vulnerabilities, email security (DKIM/DMARC), data breaches, leaked credentials, certifications, privacy policy, cloud hosting and data residency, and the vendor's own suppliers. Each vendor gets a rating from AAA to D with separate Security and Privacy sub-ratings.
You set an impact tier per vendor, CyberRank combines it with breach likelihood into a risk level and heat map, monitored vendors are reassessed nightly, and questionnaires can be sent automatically to vendors below your baseline. The rating is a posture indicator under a published method; it complements questionnaires and audits rather than replacing them. See how CyberRank works.
Evaluating several platforms? See how CyberRank compares with other vendor risk tools, feature by feature.
Conclusion
Third-party risk management works when it is proportionate and continuous: know every third party, tier them by impact, assess each tier at the right depth, contract for what matters, and watch for change. Start with the inventory and the critical tier; the rest of the lifecycle builds on that foundation.
CyberRank gives you the cyber half of that programme from day one: rate your first vendor with the free CyberRank security rating, then add tiers, monitoring and reports as the programme grows.
Related reading: supply chain attacks, how they work and how to prevent them; and can you detect a supply chain attack from outside a vendor?
References
- NIST, SP 800-161 Rev. 1 (update 1): Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29
- NIST, SP 1305: CSF 2.0 Quick-Start Guide for C-SCRM
- ENISA, Threat Landscape for Supply Chain Attacks (2021)
- Cloud Security Alliance, Cloud Controls Matrix and CAIQ v4.1
Quick answers
Short, direct answers to questions this article raises.
- Quick answerVendor Risk Management for BanksHow banks manage vendor and outsourcing risk under OJK and DORA, which vendors to tier first, and how CyberRank gives regulators continuous evidence.
- Quick answerVendor Risk Management for HealthcareHow hospitals and clinics manage third-party risk for patient data under UU PDP, which suppliers to check first, and how CyberRank monitors them.
- Quick answerVendor Risk Management for Government & SOEsHow government agencies and SOEs manage supplier cyber risk, which vendors matter most, and how CyberRank provides independent evidence.
- Quick answerVendor Risk Management for Listed CompaniesHow publicly listed companies oversee supplier cyber risk at board level, what evidence investors expect, and how CyberRank reports it.
- Quick answerHow Often Should Vendors Be Reassessed?Vendor reassessment frequency by risk tier, the events that trigger an out-of-cycle review, and how CyberRank reassesses vendors nightly.
Frequently asked questions
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating