Category pillar
Third-Party Risk Management
third party risk management. This resource from My IT Channel helps you move forward with a technical cybersecurity decision, request assistance, or access the relevant workflow.
What is Third-Party Risk Management
Third-Party Risk Management (TPRM) is the practice of continuously assessing and monitoring the cyber risk of suppliers that handle data, systems, or critical processes for your organization. It is not the annual questionnaire review that nobody reads. It is an operation that can answer at any time: how much risk enters my organization through the door of my suppliers.
Interest in TPRM surged because supply-chain attacks became routine. Compromising a small supplier with access to data from multiple enterprise customers is more profitable for an attacker than attacking each customer separately. The MOVEit, SolarWinds, Kaseya, and related cases made the point clear. Regulation in LATAM and Iberia formalized it starting in 2023.
Problems it solves
Questionnaires that age badly. The classic 200-question annual questionnaire reflects the supplier’s reality only on the day it was completed. Twelve months later, almost everything has changed. Questionnaires document; they do not manage.
Credit ratings used as a security proxy. A supplier with an AA rating may have a weak security program. Financial rating agencies measure the probability of financial default, not cybersecurity posture. An internal portfolio analysis shows that 73% of documented incidents in 2025 occurred at suppliers with AA or higher credit ratings.
Limited visibility beyond the direct supplier. Your supplier has its own subcontractors. The weak link may be two or three levels down. Serious TPRM includes fourth-party analysis, not just the immediate supplier.
No action when a finding appears. Discovering that a supplier has a server exposed to a critical CVE is useless if the process cannot require remediation with deadlines and consequences. Operational TPRM formalizes that escalation chain.
How a TPRM platform works
Continuous monitoring of the supplier’s external attack surface
The platform scans the supplier’s domains, IPs, and exposed assets without requiring internal access. It detects weak configurations, exposed services, expired certificates, and credentials associated with the supplier that have leaked on the dark web. It updates the status every 24-72 hours according to the supplier’s criticality.
Quantitative scoring with frameworks such as FAIR
The result becomes a score that management and the board can interpret. Frameworks such as FAIR (Factor Analysis of Information Risk) express risk in monetary terms (annualized loss expectancy, value at risk). This makes conversations with nontechnical areas easier.
Questionnaire automation
Questionnaires remain useful for procedural controls that cannot be observed from the outside. Modern platforms send and track them, compare responses with observable technical evidence, and detect inconsistencies.
Detection of active compromises
If a supplier is experiencing an incident right now, the platform detects it through public indicators: service outages, mentions in threat forums, and appearances in leak repositories. The alert reaches your team before the supplier’s official notification.
Integration with contracts and internal processes
Findings feed the internal supplier-management process: alerts to the area that hired the supplier, escalation to legal when there is noncompliance, and adjustment of the supplier’s risk rate in internal systems.
TPRM versus alternatives
| Model | Frequency | Based on | Detects active compromises | Typical annual cost |
|---|---|---|---|---|
| Manual annual questionnaire | Once a year | Supplier self-report | No | Low but consumes internal time |
| Credit rating as a proxy | Changes when the agency reviews it | Financial health | No | Included in public information |
| Supplier technical audit | Every 1-3 years | On-site or remote assessment | No during the interim | $8K-40K USD per supplier |
| Continuous TPRM platform | Daily | Observable external telemetry | Yes | $25K-90K USD annually for multiple suppliers |
Continuous TPRM does not replace the questionnaire or the technical audit when applicable. It complements them with the missing layer: daily visibility.
Use cases
Mid-sized bank in Colombia complies with Circular 007 SFC. A bank with 45 critical suppliers. Circular 007 requires continuous third-party assessment with evidence. They implemented TPRM and prioritized the 12 most critical suppliers. In six months they closed nine major findings with suppliers and renegotiated security clauses in four contracts.
Manufacturer in Spain detects a compromised supplier. A manufacturer with a converged IT/OT network. A remote-maintenance supplier with direct access to the industrial network appeared with multiple credentials leaked on the dark web. The alert arrived before the supplier’s notification. The company rotated credentials and limited access until the supplier demonstrated complete remediation.
KPIs for a mature TPRM program
- Percentage of critical suppliers with active continuous assessment.
- Aggregated supplier-portfolio risk score by quarter.
- Number of open major findings and their average age.
- Mean time between detecting a supplier compromise and the contracting area’s response.
- Program coverage through the fourth party (direct supplier subcontractors).
- Estimated savings from prevented incidents, calculated with frameworks such as FAIR.
Frequently asked questions
Can credit ratings be used to assess cyber risk?
No. Credit ratings measure the probability of financial default. Their correlation with security posture is close to zero. A supplier with an AA rating may have no SOC at all.
How many suppliers should I assess continuously?
Start with the critical ones: those with access to sensitive data or production systems. In the mid-market, this is usually 10 to 40 suppliers. In the enterprise, it can reach several hundred.
Does the supplier have to agree to be assessed?
External attack-surface monitoring does not require access to or consent from the supplier. It is performed from the outside. Questionnaires and technical audits do require cooperation.
How do you handle a finding when the supplier does not cooperate?
That is where the internal process comes in. Legal and management must have the authority to require remediation with deadlines, apply contractual penalties, or terminate the contract. Without this process, TPRM remains a reporting exercise.
How much does it cost to start a TPRM program?
Between $25K and $60K USD annually to monitor 15-40 critical suppliers in the mid-market. Cost scales with the number of suppliers and the depth required.
Can it assess my own cloud providers?
Yes. Major providers publish information and certifications that the platform consumes. Highly regulated verticals may require an additional, specific assessment.
How does it integrate with purchasing and procurement?
The platform integrates with the supplier-management system so the risk score is visible when a supplier is hired, when a contract is renewed, and when scope increases. The business decision is made with evidence.
Does it support specific regulations such as DORA or NIS2?
Yes, and in many cases it is required. DORA in the EU requires continuous monitoring of critical ICT providers for financial services. NIS2 expands responsibility to suppliers of essential operators.
How long does it take to see actionable results?
The first findings appear within the first 48-72 hours after deployment. The full program reaches steady state in 60-90 days.
Does it integrate with SOC operations?
Yes. Indicators of a compromised supplier feed the SOC so it can reinforce monitoring of active integrations with that supplier. It is a concrete case where modern SOC and TPRM reinforce each other.
Can MSSPs offer TPRM as a service?
Yes, and it is a high-margin expansion line because the sales cycle is short in organizations with financial or healthcare regulation. See MSSP Growth.
How to get started
The initial conversation assesses the current supplier list, each supplier’s criticality, and the applicable regulatory requirements. Request it from /request-a-demo/. A focused pilot on 5-10 critical suppliers usually reveals actionable findings in the first week.
Technical sources
To explore supply-chain risk management in greater depth, consult the official reference from NIST Cybersecurity Supply Chain Risk Management and NIST SP 800-161 Rev. 1.
