Third-party risk management (TPRM) is the process, and the software, that a company uses to check whether its suppliers could let an attacker in or leak its data. A third party is any outside company that the company works with, such as a payroll provider, a cloud service, a call centre or a software vendor. TPRM is also called vendor risk management.
Why does it matter? A growing share of breaches now arrive through a supplier, not through the company's own systems. An attacker breaks into a small payroll company and uses its access to reach every one of its clients. This is called a supply chain attack. In India, the RBI also requires banks to assess and monitor the IT companies to which they outsource work.
TPRM works in four steps. First, the company lists every supplier and sorts them into tiers by risk. A supplier that holds customer data or connects to the company's network goes into the top tier. A supplier that only delivers office stationery goes into the bottom tier. Second, the company sends each important supplier a questionnaire, a list of questions about its security, often a few hundred questions long. The supplier answers and uploads evidence, such as its security certificates. Many suppliers now draft their answers with security questionnaire automation. Third, the TPRM software scans the supplier from the outside, as an attacker would, with the same methods as external attack surface management (EASM). Fourth, it keeps watching after the contract is signed. It raises an alert if the supplier's score drops, or if the supplier appears in news of a breach.
The outside-in scan matters because a questionnaire only records what the supplier says about itself. Here is a typical case. A private bank in Chennai has 600 suppliers, and 45 of them are in the top tier. One of them, a company that prints and posts account statements, answers its questionnaire well. It says that all its servers are patched. But the outside-in scan finds that one of the printing company's servers faces the internet and runs software with a known flaw. The bank asks the supplier to fix it within 15 days and to send proof. Until then, the bank stops sending it new customer files.
The results go to the company's GRC platform, where every supplier sits in the risk register with its score and its open findings. Cyber risk quantification can include the supplier scores in its estimate of the company's own risk.
TPRM is different from know your business (KYB). KYB checks that a business is real, and who owns it. TPRM assumes that the supplier is real, and checks whether its security is good enough.