Third-party risk management (TPRM) is the program a company uses to find, assess and reduce the risks that come from vendors, suppliers and service providers. It covers choosing suppliers, checking them, writing security terms into contracts, and watching them for as long as they work with you.
- Also Called3other namesTPRM · vendor risk management · supplier risk management
- Related Terms3linked entriesThird-party risk · Supply chain attack · Exposure management
How does TPRM work?
NIST calls the formal practice cybersecurity supply chain risk management: a systematic process for managing exposure to cybersecurity risks throughout the supply chain. In daily work it comes down to six steps.
- Inventory: list every vendor and note what data and access each one has.
- Tier: rank vendors by how much damage a failure could cause.
- Assess: use questionnaires, evidence and outside-in checks.
- Contract: add security duties, breach notice and audit rights.
- Monitor: watch for changes between reviews.
- Exit: plan how to leave a vendor safely.
This page is about the program. The exposure itself has its own entry, third-party risk.
Why does it matter in the EU, APAC and the US?
The Verizon 2025 Data Breach Investigations Report found that third parties were involved in 30% of breaches, up from 15% the year before. Regulators now set rules for it.
- EU: DORA has applied since 17 January 2025. It asks financial entities to keep a register of information on their ICT third-party arrangements. NIS2 lists supply chain security among its required measures.
- Australia: APRA's CPS 230 took effect on 1 July 2025 and covers material service providers.
- US: New York's 23 NYCRR 500.11 requires covered entities to keep a written policy on third-party service provider security.
How does TPRM compare with related practices?
| Practice | Scope | Question it answers |
|---|---|---|
| TPRM | The whole vendor life cycle. | How do we manage vendor risk? |
| Vendor risk assessment | One review at one point in time. | Is this vendor safe enough today? |
| Supply chain risk management | The wider chain of products and parts. | Where can the chain break? |
| Continuous vendor monitoring | Outside signals about vendors. | Has anything changed since the last review? |
For ongoing vendor checks that go beyond a yearly questionnaire, see our third-party risk management platform.
Which vendors need the closest look?
- Vendors that hold sensitive data.
- Vendors with network or admin access to your systems.
- Vendors that run services you cannot do without.
- Sole-source suppliers that you cannot replace quickly.
- Fourth parties, the suppliers your vendors depend on.
Where do programs go wrong?
The most common gap is a yearly questionnaire that nobody checks. Others skip tiering, so every vendor gets the same review. Some programs have no named owner or no exit plan. A vendor can change a lot between two reviews, which is why monitoring matters.
A hosting provider shows how fast that can happen. In October 2026 DreamHost reset email and FTP/SFTP passwords for some accounts after an incident it reported on its status page. The affected users could not sign in until the account owner set new ones. Our DreamHost incident guide lists what hosting customers should check.
See also
Also Called.
- NameTPRM
- Namevendor risk management
- Namesupplier risk management
Questions.
-
What is the main purpose of third-party risk management?
It keeps the risks that come with vendors and suppliers at a level you accept. It does this through checks before you sign, clear contract terms and monitoring afterwards.
-
What is a TPRM framework?
It is a documented way of working: how you list vendors, rank them, assess them, set contract terms, monitor them and end the relationship.
-
Is TPRM the same as vendor risk management?
The terms are often used for the same thing. TPRM is a little wider because it also covers contractors, partners and service providers.
-
How often should vendors be assessed?
It depends on risk. Critical vendors need reviews and monitoring all year. Low-risk vendors can be reviewed less often.