Term

Third party risk

Risk introduced by vendors and service providers.

Third party risk (also called vendor or supplier risk) is the exposure an organization inherits from the parties it relies on. Managing it involves inventory, tiering, due diligence, and continuous monitoring.

Vendor risk
Due diligence

Definition

Third-party risk, explained

Outsourcing a function does not outsource accountability for it. When a payroll provider leaks employee records or a cloud service goes down, customers and regulators still look at the organization that chose the vendor. Third-party risk management is the discipline of knowing who you depend on, how much, and what happens if they fail.

Security is only one kind of vendor risk

Risk type, What it looks like comparison
Risk type	What it looks like
Security and privacy	A vendor holding your customer data is breached, or processes it in ways your contracts do not permit
Operational	An outage at a critical SaaS or infrastructure provider stops your own service
Financial	A key supplier becomes insolvent with no transition plan in place
Compliance	A vendor's practices put you in breach of a regulation or customer contract
Concentration	Many critical services depend on the same underlying provider
Reputational	A vendor's conduct becomes associated with your brand

Tiering: not every vendor deserves the same scrutiny

Sending a 200-question security questionnaire to your office snack supplier wastes everyone's time, and it dilutes attention from the vendors that matter. Tiering assigns effort by criticality and data access. A simple three-tier model looks like this:

Example tiering model

Example tiering model
Tier	Criteria	Due diligence	Review cadence
Tier 1: Critical	Access to sensitive customer data or production, or outage would stop the service	Full questionnaire, SOC 2 or ISO 27001 report review, contract security terms	Annually plus continuous monitoring
Tier 2: Important	Limited internal data access or moderate business impact	Short questionnaire and certification check	Every two years
Tier 3: Low	No data access and easily replaced	Basic inventory record	At renewal

The free vendor tiering model and vendor security questionnaire are ready to adapt.

The lifecycle

Inventory: find every vendor, including those bought on company cards and free tools connected to corporate identity.
Tier: classify by data access and business criticality.
Assess: collect questionnaires and assurance reports proportionate to tier, and record findings in the risk register.
Contract: agree security, breach notification, audit, and data processing terms before signing.
Monitor: re-assess on schedule and watch for breaches, report expiries, and changes in service.
Offboard: revoke access, retrieve or confirm deletion of data, and update the inventory.

Fourth parties and the shared-responsibility gap

Your vendors have vendors. A SaaS provider's own hosting and support subcontractors are your fourth parties, and a failure there reaches you just as surely. Review subprocessor lists for critical vendors. When reading a vendor's SOC 2 report, check the complementary user entity controls section too: it lists the controls you must operate for the vendor's controls to be effective, and missing them creates a gap no questionnaire will reveal.

What frameworks expect

ISO/IEC 27001:2022 Annex A covers suppliers in controls 5.19 to 5.23, spanning supplier relationships, agreements, the ICT supply chain, monitoring and change, and cloud services. The SOC 2 Common Criteria address vendor and business partner risk under CC9.2. GDPR requires written terms with processors. For building the full program, see the vendor risk program guide.

FAQ

Frequently asked questions

Is third-party risk the same as vendor risk?

The terms are often used interchangeably. Third-party risk is slightly broader, since it can include partners, resellers, contractors, and affiliates that are not vendors in the purchasing sense. In practice most programs start with vendors and suppliers, then extend the same process to other external parties that access data or systems.

Is a vendor's SOC 2 report enough due diligence?

It is strong evidence, but not sufficient on its own. Check that the report's scope covers the services you use, that the period is recent, what exceptions were found, which subservice organizations were carved out, and which complementary user entity controls you must operate. Supplement it with contract terms and questions about anything outside scope.

How often should vendors be reassessed?

Base it on tier. Critical vendors are commonly reassessed annually and monitored continuously between assessments. Lower-risk vendors may be reviewed every two years or only at contract renewal. Trigger an off-cycle review when a vendor has a breach, changes ownership, or starts processing new types of data for you.

What is a fourth party?

A fourth party is a vendor's vendor, such as the cloud host or support contractor used by one of your SaaS providers. You have no direct contract with them, but their failure can still affect you. Organizations manage this indirectly by reviewing subprocessor lists and requiring vendors to oversee their own suppliers.

Keep exploring

Ready to replace the spreadsheet chaos?

See Asurvo in action with a 20-minute walkthrough tailored to your stack and frameworks.

Request a demo Talk to sales