Almost every organization now runs on outsiders — cloud platforms, contractors, component suppliers, payment processors, the small firm that holds a set of plant drawings. Each one is a door into your business. Third-party risk management is the discipline of knowing where those doors are, how much they matter, and whether they're locked. This guide covers what TPRM is, how a program runs end to end, how to decide where to spend effort, and where the common approaches quietly fail.
Third-party risk management (TPRM) is the practice of identifying, assessing, and controlling the risks your organization inherits from vendors, suppliers, and other external parties — across cyber, operational, financial, compliance, and reputational dimensions, over the entire life of each relationship.
A third party is any external entity you have a relationship with: vendors and suppliers, service providers, contractors and subcontractors, resellers, agents, and business partners. Third-party risk is the risk any of them introduces to your operations, your data, your customers, or your compliance posture. TPRM is the program that manages it.
People use several terms for overlapping ideas, so it's worth being precise. Vendor risk management (VRM) usually means the risk from suppliers you pay. Supply chain risk management (SCRM) leans toward the flow of goods and software components. Third-party risk management is the widest of the three — it includes any external party with access or influence, paid or not. And fourth-party risk is the risk from your vendors' vendors: the subprocessor your SaaS provider relies on, whom you never contracted with but still depend on.
Crucially, TPRM is not just a cybersecurity concern. A vendor can fail financially, breach a regulation, suffer an outage, or damage your reputation without any hacker involved. A complete program treats cyber, operational, financial, compliance, and reputational risk as one picture.
Two things have changed. First, the attack surface moved outside the perimeter: the average enterprise now depends on hundreds or thousands of external parties, and a large share of reported breaches trace back to a third party rather than the target itself. When the incident starts at a supplier, your controls never see it coming — but your customers and regulators still hold you accountable.
Second, regulators made third-party oversight non-negotiable. In the EU, DORA requires financial entities to maintain a register of all ICT third-party arrangements and manage that risk actively; NIS2 puts supply-chain security and incident reporting on the board's desk for essential and important entities; and GDPR makes you responsible for the processors that handle personal data on your behalf. "We didn't know our vendor was exposed" is no longer a defense.
A mature TPRM program isn't a one-time review; it runs across the whole life of each relationship. The stages are consistent even when the tooling isn't:
It ingests your full vendor master, classifies every record by your exposure, and scopes assessment depth to the vendors that actually hold something of yours — the whole register, not a sample.
How inside-out classification works →The single most consequential decision in a TPRM program is how you tier vendors, because tier decides how hard you look. Get it wrong and you either drown every supplier in the same 300-question form or, more commonly, ration real scrutiny to a shortlist you already suspected — and miss the quiet vendor that turns into next year's incident.
Many programs tier by the wrong variable. Spend is a poor proxy for risk: your most dangerous vendor may be cheap. An external security rating — an A-to-F grade derived from internet scanning — measures what a vendor exposes to the public internet, which has little to do with what they hold of yours. A contractor with a copy of your plant blueprints has no attack surface a scanner can find, and no score will flag them.
The more defensible approach tiers by your own exposure — what a given vendor holds, reaches, or touches. Six access vectors capture almost all of it:
Score a vendor across these six and the tier falls out of it: a handful of vendors touch several high-value vectors and warrant full-depth scrutiny; most touch one or none and need a proportionate check or a signed attestation. Depth follows exposure — not vendor count, and not spend. This is the model Polestead is built on; our guide to inside-out vs outside-in risk works through why it catches what ratings miss.
You don't have to invent a program from scratch. Several references define what good looks like, and regulation increasingly mandates the shape:
Frameworks tell you what to cover. They deliberately don't tell you how to operate — the tooling, the tiering logic, and the deployment model are yours to choose.
1. Assessing a sample, not the register. Coverage limited to the vendors you already worry about leaves the long tail unclassified — and regulation like DORA doesn't ask for a representative sample.
2. Confusing an external score with risk. A security rating grades internet-facing posture, not what a vendor holds of yours. Use it as one evidence signal, never as the verdict.
3. Point-in-time only. An assessment at onboarding tells you nothing about the breach eighteen months later. Continuous monitoring closes the gap between reassessments.
4. Questionnaire fatigue. Sending every vendor the same enormous form buries the answers that matter and burns goodwill on both sides. Scope depth to tier instead.
5. Skipping offboarding. Access and data that outlive the contract are pure downside risk. Make revocation and data return part of the lifecycle, not an afterthought.
The practice of identifying, assessing, and controlling the risks a company inherits from its vendors, suppliers, contractors, and other external parties — across cyber, operational, financial, compliance, and reputational dimensions, over the whole relationship lifecycle.
They overlap. Vendor risk management usually means suppliers you pay; third-party risk management is broader, covering any external party with access or a relationship. TPRM is the wider discipline, and fourth-party risk extends it to your vendors' vendors.
By exposure — what a vendor holds, reaches, or touches of yours across data, network, facilities, designs, people, and supply — rather than by spend or by an external score. Tier then sets assessment depth. See our inside-out risk page.
NIST SP 800-161r1 and NIST CSF 2.0 (GV.SC) are the core references; ISO/IEC 27036 is the international standard; and DORA, NIS2, and GDPR impose obligations in the EU. Frameworks define coverage; the operating model is your choice.