Vendor risk management (third-party risk)

A company can invest heavily in its own security, but if a vendor has access to its data or systems, the vendor's weakness becomes the company's weakness. More and more attacks do not hit the target directly. They come through the chain: through a software provider, an outsourced IT firm, an accountant, or any partner with access. That is why vendor risk management, also called third-party risk, is now a necessary part of security. This post explains why, and how to manage it.

This is part of our security program overview. We run vendor risk management through governance, risk, and compliance.

Why vendor risk keeps growing

A modern company relies on dozens of external services: cloud, software, outsourced IT, payment systems, marketing tools. Each one can have access to data or systems. Attackers have noticed. Instead of attacking a well-defended target directly, they attack a less-defended vendor and come in through it. One compromised provider can hit all of its clients at once.

What vendor risk management covers

The goal is to make the risk that enters through partners known and controlled, not invisible.

1. 01
   Inventory your vendors

   Know who has access to your data and systems, and how critical each one is.
2. 02
   Assess the risk

   Rate each vendor's security in proportion to how important they are to you.
3. 03
   Fix it in the contract

   Agree on security obligations, incident reporting, and the right to verify.
4. 04
   Limit access

   Give each vendor only the access they actually need, and no more.
5. 05
   Monitor over time

   Vendor risk is not a one-off. Review it regularly.

Assessment in proportion to importance

Not every vendor needs the same attention. A provider that processes your personal data or has access to critical systems calls for a thorough assessment and clear contractual obligations. A vendor with no access to sensitive data needs less. Effort should be directed in proportion to how much a vendor's failure would hurt, which follows from your risk assessment.

The link to compliance

Supply-chain risk management is an explicit regulatory requirement. NIS2 requires in-scope entities to manage the security of their suppliers, and DORA sets detailed requirements on the risk of third-party ICT service providers for the financial sector. This is no longer optional. It also fits the broader discipline of risk management.

How Raptoric helps

We help inventory and assess your vendors, set security obligations in contracts, and monitor the risk over time, through governance, risk, and compliance. Book a scoping call.