Third-Party Risk Management (TPRM): Practical Supply Chain Security Guide 2025

Last Updated: January 16, 2025 | Author: Don Amel

Executive Summary

Third-party risk is now a core security requirement. NIS2 explicitly mandates supply chain security, GDPR expects processor oversight, and ISO 27001 (A.5, A.8, A.15 in Annex A) requires vendor controls and monitoring. This guide provides a practical, repeatable approach to vendor risk management that aligns with EU regulations and real-world constraints.

Key takeaways:

• Inventory and classify vendors before you assess them.
• Focus on critical services first (cloud, MSP/MSSP, payroll, CRM, core SaaS).
• Evidence-based assessments reduce audit risk and improve remediation.
• Contracts and monitoring are as important as questionnaires.

Table of Contents

1. What is TPRM and why it matters
2. Build the vendor inventory
3. Risk tiering model (criticality)
4. Due diligence and evidence collection
5. Contractual controls and SLAs
6. Continuous monitoring and reassessment
7. Incident response with vendors
8. Metrics and governance
9. 90-day implementation roadmap
10. Common pitfalls

---

1. What is TPRM and why it matters

Third-Party Risk Management (TPRM) is the structured process of identifying, assessing, and mitigating risks introduced by vendors, suppliers, and partners. The goal is not to eliminate third parties, but to ensure the risk is understood, controlled, and measurable.

Regulatory pressure is increasing:

• NIS2 requires supply chain security controls and documented risk management.
• GDPR requires due diligence and oversight for processors and subprocessors.
• ISO 27001 expects formal supplier security governance and monitoring.

If a critical vendor fails, your organization is accountable. The best TPRM programs focus on the highest-impact vendors and build a clear audit trail.

---

2. Build the vendor inventory

You cannot assess what you cannot see. Start with a complete vendor inventory with clear ownership and business context.

Minimum fields to capture:

• Vendor name and legal entity
• Service provided and business owner
• Data types handled (PII, financial, health, IP)
• Access level (none, read, write, admin)
• Integration type (API, SSO, VPN, on-prem)
• Hosting model (SaaS, PaaS, IaaS, on-prem)
• Contract renewal and termination dates

Practical tip: synchronize procurement, finance, and IT asset data. Shadow IT often accounts for the highest unassessed risk.

---

3. Risk tiering model (criticality)

Use a simple tiering model to prioritize effort. A four-tier approach works well for most organizations.

Example tiering criteria:

• Critical: Business operations stop within 24 hours if vendor fails.
• High: Sensitive data exposure or significant revenue impact.
• Medium: Limited data exposure or manageable operational impact.
• Low: Minimal data access and low operational dependency.

Scoring dimensions to include:

• Data sensitivity
• Privileged access level
• System integration depth
• Substitutability and time-to-replace
• Regulatory impact (NIS2/GDPR)

Sample scoring rubric (0-3 scale):

Data sensitivity:     0 public | 1 internal | 2 confidential | 3 regulated
Access level:         0 none   | 1 read     | 2 write        | 3 admin
Operational impact:   0 low    | 1 medium   | 2 high         | 3 critical
Substitutability:     0 easy   | 1 moderate | 2 hard         | 3 very hard

Total score:
0-3   = Low
4-6   = Medium
7-9   = High
10-12 = Critical

---

4. Due diligence and evidence collection

Questionnaires alone are not enough. Require evidence for high-risk vendors.

Minimum evidence for Critical and High tiers:

• ISO 27001 certificate or SOC 2 Type II report
• Penetration test summary (last 12-18 months)
• Data processing addendum and subprocessors list
• Incident response plan and notification timeline
• Encryption and key management details
• Business continuity and disaster recovery overview

Verification tactics:

• Validate certificates against accreditation bodies.
• Request redacted audit reports (not just marketing summaries).
• Ask for control mapping to your requirements (NIS2/GDPR/ISO).

---

5. Contractual controls and SLAs

Contracts are enforceable security controls. Standardize a security addendum with non-negotiable clauses.

Core clauses to include:

• Incident notification timelines (24/72 hours for NIS2 alignment)
• Right to audit (or third-party audit acceptance)
• Data residency and transfer rules
• Subprocessor approval and change notification
• Minimum security baseline (MFA, logging, encryption)
• Termination and data deletion timelines

SLA focus: uptime, RTO/RPO, and escalation obligations for security incidents.

---

6. Continuous monitoring and reassessment

Vendor risk is not static. Reassess on a cadence aligned with criticality.

Recommended cadence:

• Critical: quarterly (or upon major changes)
• High: semi-annual
• Medium: annual
• Low: every 2 years

Continuous signals to track:

• Security advisories or breach notifications
• Certificate expirations
• Major product changes or acquisitions
• Changes in subprocessors

---

7. Incident response with vendors

Your incident response plan must include third-party coordination. If a vendor is involved, you need defined communication paths and responsibilities.

Minimum requirements:

• Named security contacts and escalation paths
• Joint incident response playbook
• Log retention and evidence preservation commitments
• Clear timelines for regulatory notification

Run joint tabletop exercises for critical vendors at least annually.

---

8. Metrics and governance

Track a small set of metrics that can be reported to leadership and auditors.

Suggested KPIs:

• % of vendors risk-tiered
• % of critical vendors with completed evidence review
• Average time to remediate vendor findings
• Number of vendors out of compliance with contract clauses

Governance model:

• Security owns the risk framework
• Procurement enforces contract controls
• Business owners approve onboarding and risk exceptions

---

9. 90-day implementation roadmap

Days 1-30: Foundation

• Build vendor inventory
• Define tiering criteria
• Identify top 20 critical vendors

Days 31-60: Assessment

• Run critical/high assessments
• Collect evidence and confirm certifications
• Document risk acceptances

Days 61-90: Control

• Update contracts with security addendum
• Build reassessment cadence
• Launch governance reporting

---

10. Common pitfalls

• Treating questionnaires as evidence
• No linkage between procurement and security
• Over-assessing low-risk vendors and ignoring critical ones
• Missing subcontractor visibility
• No defined remediation timelines

---

Final Checklist (Quick Reference)

• Vendor inventory is complete and owned
• Tiering criteria are documented and approved
• Critical vendors have evidence-based assessments
• Contracts include security addendum and SLAs
• Reassessment cadence is defined
• Vendor incident response is tested

If you need support building or accelerating a TPRM program, our team can help align your vendor risk model with NIS2, GDPR, and ISO 27001 requirements.

---

Related Articles

• NIS2 Directive Compliance Guide
• GDPR Compliance Checklist 2025
• Incident Response Playbook

Related Services

• NIS2 Compliance Consulting
• GDPR Compliance Consulting