<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-third-party-risk-management
description: >-
  Implement third-party risk management (TPRM) programs covering vendor assessment, due diligence, continuous monitoring, contractual security requirements, and supply chain risk analysis.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - tprm
  - vendor-risk
  - supply-chain
  - due-diligence
  - third-party
  - vendor-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1199"]
---

# Performing Third-Party Risk Management

## Overview

Third-party relationships introduce risks that organizations cannot directly control. This technique covers building TPRM programs from vendor tiering and assessment through continuous monitoring and contract management, addressing supply chain attacks and concentration risk.

Mode: `[MODE: ARCHITECT]` — Third-party risk management program design and execution.

## Prerequisites

| Requirement | Details |
|---|---|
| Vendor inventory | Complete list of third-party relationships |
| Assessment questionnaires | SIG, CAIQ, or custom |
| Python 3.10+ | For agent tooling |

## Workflow

### 1. Vendor Tiering Model

```
Vendor risk classification:
├── Tier 1 (Critical): Direct access to sensitive data/systems
│   ├── Full security assessment required
│   ├── On-site audit rights in contract
│   ├── Continuous monitoring (SecurityScorecard, BitSight)
│   ├── Annual reassessment mandatory
│   └── Examples: Cloud provider, payment processor, EHR system
├── Tier 2 (High): Indirect data access or critical service
│   ├── Detailed questionnaire (SIG Lite or CAIQ)
│   ├── SOC 2 Type II report review
│   ├── Quarterly monitoring
│   └── Examples: HR SaaS, email provider, CI/CD platform
├── Tier 3 (Medium): Limited access, non-critical service
│   ├── Standard questionnaire
│   ├── Annual self-attestation
│   └── Examples: Marketing tools, travel booking
└── Tier 4 (Low): No data access, commodity service
    ├── Basic due diligence only
    └── Examples: Office supplies, janitorial services
```

### 2. Assessment Workflow

```
Due diligence process:
├── 1. Pre-engagement screening
│   ├── Business justification review
│   ├── Data flow analysis (what data is shared)
│   ├── Preliminary risk rating
│   └── Regulatory requirements check
├── 2. Security assessment
│   ├── Questionnaire (SIG, CAIQ, custom)
│   ├── SOC 2 / ISO 27001 cert review
│   ├── Penetration test results review
│   ├── Insurance coverage verification
│   └── BCP/DR capabilities assessment
├── 3. Risk evaluation
│   ├── Score against criteria
│   ├── Identify gaps and residual risks
│   ├── Document compensating controls
│   └── Risk acceptance or rejection decision
├── 4. Contracting
│   ├── Security requirements addendum
│   ├── Data processing agreement (DPA)
│   ├── Incident notification SLA (72 hours)
│   ├── Right-to-audit clause
│   └── Termination and data return provisions
└── 5. Continuous monitoring
    ├── External rating services (BitSight, SecurityScorecard)
    ├── Dark web monitoring for vendor breaches
    ├── Periodic reassessment per tier schedule
    └── Trigger-based reassessment on incidents
```

### 3. Supply Chain Risk

```
Supply chain considerations:
├── Concentration risk: single-vendor dependencies
├── Fourth-party risk: vendor's vendors
├── Software supply chain: dependency analysis
│   ├── SBOM (Software Bill of Materials) review
│   ├── Open-source vulnerability scanning
│   └── Build pipeline integrity verification
└── Geopolitical risk: vendor jurisdiction analysis
```

## Verification

- [ ] Process documented and approved
- [ ] Stakeholders identified and engaged
- [ ] Tooling configured and automated where possible
- [ ] Outputs reviewed and validated
- [ ] Reporting integrated into GRC program
- [ ] Periodic review schedule established
