Your auditor wants to see how you oversee vendors, a regulator or bank partner expects a third-party risk program, and meanwhile your own customers keep sending you questionnaires. A vendor and third-party risk program gives you an inventory you trust, due diligence in proportion to each vendor’s risk, and a calm, consistent answer when someone asks who has your data, and who has theirs.
Third-party risk management (TPRM) is how you identify, assess and control the risk that comes from the vendors, service providers and partners who touch your systems, data or operations. A working program covers the whole relationship: due diligence before you sign, security terms in the contract, ongoing monitoring while the vendor is in place, and a clean exit when it ends. It also reaches the fourth parties your vendors depend on, because a breach at your provider’s provider still lands on you.
Every major framework now expects it. NIST CSF 2.0 created a dedicated cybersecurity supply chain risk management category (GV.SC) in its Govern function, and NIST SP 800-161 Rev. 1 sets out supply chain risk management practices in depth. SOC 2 CC9.2 and the ISO/IEC 27001 Annex A supplier controls cover vendor oversight; PCI DSS Requirement 12.8 governs third-party service providers; HIPAA requires business associate agreements; NYDFS Part 500 requires a third-party service provider security policy. Banks and their partners work under the federal banking agencies’ interagency guidance on third-party relationships, which expects oversight in proportion to risk.
The other side of TPRM is being the vendor. Your customers send you the SIG, the CSA CAIQ or their own spreadsheets, and the same questions arrive in different words again and again. A good program lets you answer from one maintained body of evidence, so security reviews stop stalling deals and your answers stay consistent from one customer to the next.
Banks, credit unions, fintechs and their partners are expected to manage third-party relationships across their life cycle, and NYDFS-regulated entities need a written third-party service provider policy. You need a program an examiner can follow from inventory to oversight.
Vendor management is a control area auditors test closely, and evidence of actual reviews is often thin. You need a process that produces records as a matter of course, not in a rush before fieldwork.
Your sales team is fielding the SIG, the CAIQ and custom questionnaires, and each one pulls an engineer away from real work. You need a single maintained answer set and the evidence pack that backs it.
Business associates handle your ePHI, and HIPAA expects satisfactory assurances and an agreement for each. You need to know who they are, what they hold and what they have committed to.
No certificate — the result is your own third-party risk program
A documented, risk-tiered vendor program with the records regulators, auditors and customers review
No body certifies a TPRM program. Your SOC 2 auditor, ISO/IEC 27001 certification body, examiner or customer evaluates it as part of their own work, and readiness gives them a program with the records to back it up.
A policy and operating procedure that define your tiers, the due diligence each tier requires, who can approve a vendor and when reassessment is due.
Your vendors listed with business owners, the data and systems each touches, criticality and a risk tier you can defend to an auditor or examiner.
Due-diligence questionnaires sized to each tier, so critical vendors get depth and low-risk vendors get a light touch.
A structured way to read a vendor’s SOC report, record exceptions and carved-out subservice organizations, and track the complementary user entity controls you are responsible for.
Model security clauses for your legal team to adapt, covering notification, audit rights, subcontractors, data handling and exit.
Completed reviews of your highest-risk vendors, with findings, follow-up requests and any risks you choose to accept documented.
A maintained set of answers and supporting evidence for the SIG, the CAIQ and the questions your own customers ask most often.
A summary of third-party risk posture, the status of critical vendors and open issues that leadership and examiners can follow.
Better found now, by people on your side, than by your assessor.
No complete vendor inventory, especially for SaaS bought outside procurement
Every vendor sent the same long questionnaire, so critical vendors get no deeper review than low-risk ones
SOC reports collected but never read, with exceptions and complementary user entity controls ignored
ISO/IEC 27001 certificates accepted without checking that the certified scope covers the service you use
Contracts with no breach-notification, right-to-audit or subcontracting terms
Due diligence performed at onboarding and never revisited
No view of fourth parties or of concentration on a single cloud or service provider
Vendor access and data left in place after the relationship ends
Gives your customers’ third-party risk teams the independent test evidence and summary letter they ask for when they review you as a vendor.
What the test coversTests the API integrations that connect vendors to your systems, where third-party access often reaches further than anyone intended.
What the test coversShows customers and auditors that your internet-facing exposure has been independently tested, a standard request in vendor due diligence.
What the test coversThe SIG (Standardized Information Gathering questionnaire) is maintained by Shared Assessments and covers a broad range of risk domains, with fuller and lighter versions for different levels of scrutiny. The CAIQ (Consensus Assessments Initiative Questionnaire) comes from the Cloud Security Alliance and maps to its Cloud Controls Matrix, so it suits cloud services. Many programs use the SIG for general vendors and accept a CAIQ, often published through the CSA STAR registry, from cloud providers.
It is strong evidence, but only if you read it. Check that the report period is recent, the scope covers the service you buy, the auditor’s opinion is unmodified, any exceptions are understood, carved-out subservice organizations are covered some other way, and the complementary user entity controls the vendor relies on you to perform are actually in place. Where the report period has ended, ask for a bridge letter.
No, and trying to is why many programs stall. Tiering lets you put real effort into the vendors with access to sensitive data or critical operations and handle low-risk vendors with an inventory entry and standard terms. Regulators and frameworks expect oversight in proportion to risk, not identical treatment of every supplier.
The guidance, issued jointly by the Federal Reserve, the FDIC and the OCC, describes how banking organizations should manage third-party relationships across their life cycle. If you partner with a bank, its examiners expect the bank to oversee you, so you will see its due-diligence requests, contract terms and monitoring. A mature program of your own makes that relationship smoother and lets you manage your own vendors the same way.
Your answers are representations your company makes, so your team owns them. CyberlySecure helps you build an accurate answer library and evidence pack and reviews the difficult responses with you, so your team can reply quickly and consistently. We do not sign questionnaires or make representations on your behalf.
CSF 2.0 moved supply chain risk into the Govern function as its own category, GV.SC, covering strategy, roles, supplier criticality, contract requirements, due diligence, ongoing monitoring and end-of-relationship activities. Building your program around those outcomes gives you a structure that also maps cleanly to SOC 2, ISO/IEC 27001 and NIST SP 800-161.
One conversation with someone who does this work. You leave knowing where you likely stand and what readiness would involve for you.
Not sure where to start? One of our testers reviews your internet-facing footprint and sends you a short summary of what an attacker would see — free. Nothing you don’t own is ever touched, and there’s no sales sequence.
Free. No obligation.
