.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
What is third-party risk management (TPRM)?
Direct answer
Third-party risk management (TPRM) is how an organisation finds, assesses and monitors the risks that come from its suppliers, service providers and their own subcontractors: security, data protection, continuity and compliance risks. It covers the whole relationship, from due diligence before signing to periodic reassessment and exit. DORA, NIS2, the GDPR and ISO 27001 all require it in some form.
TPRM vs vendor risk management
The terms overlap. Vendor risk management (VRM) usually means the suppliers you buy from. TPRM is wider: it also covers partners, outsourcers, distributors and the subcontractors of your suppliers, sometimes called fourth parties. In practice most programmes start with vendors and widen the scope as regulators ask about the supply chain.
Which rules require it
- DORA: financial entities manage ICT third-party risk, keep a register of information on all ICT service contracts (Article 28) and include set terms in those contracts (Article 30).
- NIS2: essential and important entities must address supply chain security, including the security practices of their direct suppliers (Article 21(2)(d)).
- GDPR: a controller may only use processors that give sufficient guarantees, under a contract that meets Article 28.
- ISO/IEC 27001:2022: Annex A controls 5.19 to 5.23 cover security in supplier relationships, supplier agreements, the ICT supply chain, the monitoring of supplier services and cloud services.
How a TPRM programme runs
- Inventory: list every third party, what it does for you and which data and processes it touches.
- Tiering: score how much you depend on each one and how deep it reaches into your systems, then set the assessment depth by tier.
- Assessment: send a questionnaire, collect evidence such as certificates and audit reports, and rate the answers.
- Contract: write the security, audit and exit terms the assessment showed you need.
- Monitoring: watch public security signals between assessments and reassess on a schedule or when something changes.
- Exit: keep a plan for replacing critical suppliers.
TPRM in Acuna GRC
Acuna GRC keeps every supplier in one register with contacts, contract files, an evidence library and its supply chain, level by level. An exposure model, by default Dependency and Penetration, sets each supplier’s band. You send questionnaires one at a time or by campaign, the supplier answers through a portal without an account, and an evaluator rates the assessment from one to three shields. Daily scans of the supplier’s public domain add an A to F grade. See TPRM in Acuna GRC.
How Acuna GRC handles it
In Acuna GRC, TPRM keeps one supplier register with exposure scoring, questionnaires, ratings and daily security grades.
- Module
TPRM (Supplier Shield)
Suppliers, questionnaires, assessments and campaigns, with a supplier portal and supplier risk intelligence: daily scans condensed into an A to F grade, with breach and sanctions checks.
- Solution
DORA
Keep one ICT third-party register, map critical processes with RTO and RPO, find single points of failure and follow ICT incidents in one place.
- Core workspace
Implement
Requirements, the measures and controls that address them, and the business context of assets, third parties, processes, roles and staff.
Sources
- Regulation (EU) 2022/2554 (DORA), Articles 28 and 30
- Directive (EU) 2022/2555 (NIS2), Article 21
- Regulation (EU) 2016/679 (GDPR), Article 28
- ISO/IEC 27001:2022, Annex A 5.19 to 5.23
This page explains the rules in general terms and is not legal advice.
Frequently asked
How often should suppliers be reassessed?
By tier. Critical suppliers are usually reassessed every year and lower tiers less often, with an extra review when the service, the contract or the supplier’s security posture changes.
Is a security rating enough for TPRM?
No. An outside-in rating shows public signals such as email and TLS hygiene. It does not show how the supplier handles your data, so it complements questionnaires and evidence rather than replacing them.
See how Acuna GRC runs this.
Tell us your frameworks and your team. We show you how Acuna GRC runs the program.
Hosted in Switzerland, the EU or the US