Third-party risk management (TPRM): assessing your suppliers

Third-party risk management (TPRM) is the process of identifying, assessing and controlling the risks that your suppliers, service providers and subcontractors pose to your organisation. In cybersecurity, it means listing your third parties, classifying them by criticality, assessing their security, setting requirements by contract and monitoring their level over time. NIS 2 and DORA now make it an obligation for many organisations.

A third party is any external organisation you work with: SaaS software vendor, managed service provider, hosting provider, consultancy, payroll provider, carrier, and even your subcontractor's subcontractor. Each of them may access your data, connect to your information system or determine whether an activity can continue. Their level of security partly becomes yours.

Third-party risk management aims to make this exposure visible and manageable. It covers several families of risk, which the CISO often shares with procurement, legal and the DPO:

• Cybersecurity: intrusion through the supplier, leak of data hosted by them, compromised software.
• Continuity: failure of a provider on which a critical activity depends.
• Compliance: a failing GDPR processor, sector requirements not met.
• Concentration: too many activities relying on the same supplier, for example a single cloud provider.

TPRM, VRM, supplier risk: what are we talking about?

The terms overlap. TPRM refers to the broadest approach, covering all third parties. VRM (Vendor Risk Management) is limited to suppliers. European texts speak of supply chain security. In every case, third-party risk management is part of governance, risk and compliance (GRC) and follows the same logic as any risk analysis: know what matters, measure, decide, monitor.

For an attacker, compromising a supplier is often more profitable than attacking each of its customers: a single intrusion opens hundreds of doors. In 2021, the EU agency ENISA analysed 24 supply chain attacks: in around 66% of cases, the attackers targeted the supplier's code, and in 66% of cases as well, suppliers did not know or did not report how they had been compromised.

A few public cases illustrate the three ways a third party can expose you:

• Through a poisoned update: in late 2020, compromised versions of SolarWinds Orion software were distributed to its customers, to the point that the US agency CISA ordered federal agencies to disconnect them.
• Through exposed software: in 2023, the Cl0p group exploited a flaw in the MOVEit Transfer file transfer tool to steal data from many organisations using it.
• Through a provider that holds your data: in early 2024 in France, the cyberattack on two third-party payment operators for health insurance, Viamedis and Almerys, affected more than 33 million people according to the CNIL, the French data protection authority. The data was managed on behalf of complementary health insurers.

We look at these scenarios in detail, and at how to protect yourself, in our article on supply chain attacks.

Two European texts have turned third-party risk management from good practice into an obligation.

NIS 2: securing the supply chain

Article 21 of the NIS 2 Directive lists supply chain security among the minimum risk management measures, “including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”. Entities must take into account the vulnerabilities specific to each supplier, the quality of its products and its cybersecurity practices. In France, at the time of writing (September 2026), the bill on the resilience of critical infrastructure, which transposes NIS 2, is still being debated in Parliament; ANSSI is already supporting the entities concerned.

DORA: register of information and critical ICT providers

The DORA Regulation, which has applied to financial entities since 17 January 2025, goes further. Its Article 28 requires a register of information covering all ICT service arrangements with third-party providers, a risk assessment before contracting and exit strategies. Article 30 lists the mandatory contractual provisions. Finally, in November 2025, the European Supervisory Authorities designated a first list of critical ICT third-party providers, now under EU oversight.

An effective TPRM approach follows each third party from onboarding to exit. The effort is not the same for all of them: classification by criticality determines how deep the assessment goes.

1. Inventory your third parties

You cannot protect what you do not know. Cross-check data from procurement, accounts payable and IT, without forgetting SaaS subscriptions taken out directly by business units. For each third party, record the service provided, the data involved, the access granted and the internal owner of the relationship.

2. Classify suppliers by criticality

Assessing every supplier with a 200-question questionnaire would exhaust everyone. Classification sorts third parties into tiers using four simple questions: which data does the third party access, what access does it have to your information system, what happens if it stops, and can it be replaced quickly. Try it with the tool below.

3. Assess the supplier's security

The assessment is usually done with a security questionnaire, proportionate to the criticality tier, backed by evidence. Sent through a supplier assessment portal rather than by email, it is much easier to complete, chase and consolidate. How to build it, which questions to ask and how to avoid box-ticking answers is the subject of our article on the supplier security questionnaire.

4. Score and decide

The answers produce a score and a list of gaps. The decision lies with the business, informed by the CISO: approve the supplier, approve it subject to fixes, or reject it. Keep a record of the decision and its reasons.

5. Agree on a remediation plan

Each gap accepted under conditions becomes an action, with an owner at the supplier and a deadline. Without follow-up, these commitments remain a dead letter.

6. Put the requirements into the contract

The contract sets the rules: security clauses, incident notification within a defined time, right to audit, data location, reversibility. For sensitive services, these requirements are grouped in a security assurance plan.

7. Monitor over time, and prepare the exit

A supplier assessed three years ago is no longer the same. Plan reassessments according to criticality, watch for incidents affecting the supplier and keep an exit plan ready for the third parties on which your critical activities depend.

No single method is enough. Mature organisations combine several sources of information, depending on the third party's criticality tier.

Supplier risk management rarely fails for lack of method; it fails because nobody feels responsible for it. Procurement signs, the business uses, and the CISO discovers the provider at the first incident. A clear allocation of roles avoids this scenario.

• Procurement triggers the process for each new relationship and includes security clauses in contracts.
• The business owner of the relationship qualifies the need, owns the decision to approve the supplier and follows up its remediation plan.
• The CISO defines the classification, questionnaires and thresholds, analyses answers and advises on the decision.
• Legal and the DPO check the clauses, in particular those required by Article 28 of the GDPR for processors of personal data.
• Senior management sets the acceptable level of risk and arbitrates cases where a critical supplier cannot be replaced.

Indicators to track

A few indicators are enough to steer the process and report on it to management, or to a supervisory authority:

• the share of inventoried third parties that have been classified by criticality;
• the share of critical third parties assessed in the last twelve months;
• the number of open gaps and their average age;
• the share of critical contracts that contain the expected security clauses;
• the number of security incidents involving a third party over the period.

These figures show whether effort is going to the right place. A high assessment rate is worthless if the gaps found are never fixed.

Many organisations start with a spreadsheet and questionnaires sent by email. This works for a dozen suppliers. Beyond that, the limits quickly show: multiple versions, manual reminders, no history, and no way to consolidate indicators for management or for a NIS 2 or DORA inspection.

Phinasoft's third-party risk management module addresses these needs: you create your questionnaires from your requirements, your providers answer them on a dedicated portal, you give them feedback (accepted or rejected non-conformities, requests for additional information) and you track progress and compliance indicators. Each provider has a profile with the history of its assessments: you start from the previous one rather than from scratch, and you export the requirements to include in your security assurance plans. To see the full journey, from creating the questionnaire to the report, you can request a demo.