Third-Party Risk
Risk arising from suppliers, partners, service providers or other external parties that access, support or influence an organization's operations and data.
Vendors, cloud providers and contractors often hold sensitive data or system access, so a breach or outage at a supplier can become the organization's own incident, with legal, financial and reputational impact.
A company tiers 120 vendors by data access, sends security questionnaires to the 15 critical ones, requires SOC 2 Type II reports, adds breach notification clauses to contracts and reviews those vendors each year.
Questionnaires and certifications are point-in-time and self-reported, so they can miss real practices. Fourth-party risk, meaning a vendor's own suppliers, is hard to see, and tiering too many vendors as critical stretches review capacity.
Third-party risk management follows a lifecycle: inventory and tier suppliers by criticality, perform due diligence before contracting, set security and data protection requirements in contracts, monitor continuously and plan offboarding. NIST CSF 2.0 covers this under the GV.SC category, and NIST SP 800-161 Rev. 1 details supply chain risk practices at the enterprise, mission and business process, and operational levels.
AI Governance, Systems Architecture
NIST — SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices — https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final; NIST — The NIST Cybersecurity Framework (CSF) 2.0 — https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf