Third-Party Risk
What is Third-Party Risk?
The potential threat to an organisation's data security and privacy posed by the actions or security posture of its vendors, partners, and service providers. Managing third-party risk is essential for GDPR compliance, particularly regarding data processors.
Terms that appear alongside third-party risk
Each of these is named in at least one of the same controls as third-party risk. The number is how many controls name both.
- due diligence 13 shared controls
- cybersecurity 12 shared controls
- audit 10 shared controls
- concentration risk 9 shared controls
- compliance 8 shared controls
- governance 7 shared controls
- resilience 6 shared controls
- breach notification 5 shared controls
Frameworks that govern third-party risk
What the standards actually require on third-party risk
Requirements naming third-party risk across 6 standards, quoted from the control text.
Staff the central third-party function with appropriately skilled people; consider critical operations' dependence on third parties, concentration risk, geopolitical risk and fourth parties (subcontractors);
japan-fsa-cybersecurity-guidelines-for-financial-institutions::2.6-D · 2.6 Third-party risk management: desirable actions →Financial entities manage ICT third-party risk as part of ICT risk inside the ICT risk management framework, remain fully responsible for their obligations when they use ICT services, and apply proportionality according to the nature and importance of ICT depe...
DORA-Art.28 · ICT third-party risk: general principles →Intermediate control principles for ongoing monitoring of third-party risk (required, with baseline, of an AI whose inherent risk is medium). Monitoring is scaled in depth and frequency to each third party's risk;
hkma-cyber-resilience-assessment-framework-c-raf::7.3.I · 7.3 Ongoing monitoring of third-party risk: intermediate level →Risks posed by suppliers and other third parties are identified using a documented, standardised method.
australian-energy-sector-cyber-security-framework-aescsf::THIRD-PARTIES-1c · THIRD-PARTIES-1c: Defined method identifies third-party risks →Where in-house capability is limited, third parties can assist, including active penetration testing of critical OT and IT to check actual against intended defence (simulating IT attacks, social engineering or physical intrusion), though for OT this may suit o...
BIMCO-6.3 · Third party risk assessments →Operate third-party risk + supply chain + resilience + metrics + continuous improvement per NRF framework. Third-party risk must (a) maintain vendor inventory categorised by data access + critical service + payment processing + e-commerce platform + cloud serv...
NRFCS-8 · Third-Party Risk, Supply Chain, Vendor Management, Resilience, Peak-Season Readiness, Metrics, Continuous Improvement →Questions people ask about third-party risk
What is Third-Party Risk?
Why is Third-Party Risk important for compliance?
Which compliance frameworks address Third-Party Risk?
Where can I learn more about Third-Party Risk?
See how Third-Party Risk applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.