--- title: "Third-Party Risk Management (TPRM): Practical Supply Chain Security Guide 2025" author: "Don Amel, B.Sc., Compliance Lead" date: "2025-09-15" category: "Compliance & Governance" readTime: "16 min read" tags: ["Third-Party Risk Management", "Vendor Risk", "Supply Chain Security", "NIS2", "GDPR", "ISO 27001"] excerpt: "Practical guide to third-party risk management (TPRM) and supply chain security. Learn how to classify vendors, run risk assessments, and set contractual controls that satisfy NIS2, GDPR, and ISO 27001 expectations." --- # Third-Party Risk Management (TPRM): Practical Supply Chain Security Guide 2025 *Last Updated: January 16, 2025 | Author: Don Amel* ## Executive Summary Third-party risk is now a core security requirement. NIS2 explicitly mandates supply chain security, GDPR expects processor oversight, and ISO 27001 (A.5, A.8, A.15 in Annex A) requires vendor controls and monitoring. This guide provides a practical, repeatable approach to vendor risk management that aligns with EU regulations and real-world constraints. **Key takeaways:** - Inventory and classify vendors before you assess them. - Focus on critical services first (cloud, MSP/MSSP, payroll, CRM, core SaaS). - Evidence-based assessments reduce audit risk and improve remediation. - Contracts and monitoring are as important as questionnaires. ## Table of Contents 1. What is TPRM and why it matters 2. Build the vendor inventory 3. Risk tiering model (criticality) 4. Due diligence and evidence collection 5. Contractual controls and SLAs 6. Continuous monitoring and reassessment 7. Incident response with vendors 8. Metrics and governance 9. 90-day implementation roadmap 10. Common pitfalls --- ## 1. What is TPRM and why it matters Third-Party Risk Management (TPRM) is the structured process of identifying, assessing, and mitigating risks introduced by vendors, suppliers, and partners. The goal is not to eliminate third parties, but to ensure the risk is understood, controlled, and measurable. **Regulatory pressure is increasing:** - **NIS2** requires supply chain security controls and documented risk management. - **GDPR** requires due diligence and oversight for processors and subprocessors. - **ISO 27001** expects formal supplier security governance and monitoring. If a critical vendor fails, your organization is accountable. The best TPRM programs focus on the highest-impact vendors and build a clear audit trail. --- ## 2. Build the vendor inventory You cannot assess what you cannot see. Start with a complete vendor inventory with clear ownership and business context. **Minimum fields to capture:** - Vendor name and legal entity - Service provided and business owner - Data types handled (PII, financial, health, IP) - Access level (none, read, write, admin) - Integration type (API, SSO, VPN, on-prem) - Hosting model (SaaS, PaaS, IaaS, on-prem) - Contract renewal and termination dates **Practical tip:** synchronize procurement, finance, and IT asset data. Shadow IT often accounts for the highest unassessed risk. --- ## 3. Risk tiering model (criticality) Use a simple tiering model to prioritize effort. A four-tier approach works well for most organizations. **Example tiering criteria:** - **Critical:** Business operations stop within 24 hours if vendor fails. - **High:** Sensitive data exposure or significant revenue impact. - **Medium:** Limited data exposure or manageable operational impact. - **Low:** Minimal data access and low operational dependency. **Scoring dimensions to include:** - Data sensitivity - Privileged access level - System integration depth - Substitutability and time-to-replace - Regulatory impact (NIS2/GDPR) **Sample scoring rubric (0-3 scale):** ``` Data sensitivity: 0 public | 1 internal | 2 confidential | 3 regulated Access level: 0 none | 1 read | 2 write | 3 admin Operational impact: 0 low | 1 medium | 2 high | 3 critical Substitutability: 0 easy | 1 moderate | 2 hard | 3 very hard Total score: 0-3 = Low 4-6 = Medium 7-9 = High 10-12 = Critical ``` --- ## 4. Due diligence and evidence collection Questionnaires alone are not enough. Require evidence for high-risk vendors. **Minimum evidence for Critical and High tiers:** - ISO 27001 certificate or SOC 2 Type II report - Penetration test summary (last 12-18 months) - Data processing addendum and subprocessors list - Incident response plan and notification timeline - Encryption and key management details - Business continuity and disaster recovery overview **Verification tactics:** - Validate certificates against accreditation bodies. - Request redacted audit reports (not just marketing summaries). - Ask for control mapping to your requirements (NIS2/GDPR/ISO). --- ## 5. Contractual controls and SLAs Contracts are enforceable security controls. Standardize a security addendum with non-negotiable clauses. **Core clauses to include:** - Incident notification timelines (24/72 hours for NIS2 alignment) - Right to audit (or third-party audit acceptance) - Data residency and transfer rules - Subprocessor approval and change notification - Minimum security baseline (MFA, logging, encryption) - Termination and data deletion timelines **SLA focus:** uptime, RTO/RPO, and escalation obligations for security incidents. --- ## 6. Continuous monitoring and reassessment Vendor risk is not static. Reassess on a cadence aligned with criticality. **Recommended cadence:** - Critical: quarterly (or upon major changes) - High: semi-annual - Medium: annual - Low: every 2 years **Continuous signals to track:** - Security advisories or breach notifications - Certificate expirations - Major product changes or acquisitions - Changes in subprocessors --- ## 7. Incident response with vendors Your incident response plan must include third-party coordination. If a vendor is involved, you need defined communication paths and responsibilities. **Minimum requirements:** - Named security contacts and escalation paths - Joint incident response playbook - Log retention and evidence preservation commitments - Clear timelines for regulatory notification Run joint tabletop exercises for critical vendors at least annually. --- ## 8. Metrics and governance Track a small set of metrics that can be reported to leadership and auditors. **Suggested KPIs:** - % of vendors risk-tiered - % of critical vendors with completed evidence review - Average time to remediate vendor findings - Number of vendors out of compliance with contract clauses **Governance model:** - Security owns the risk framework - Procurement enforces contract controls - Business owners approve onboarding and risk exceptions --- ## 9. 90-day implementation roadmap **Days 1-30: Foundation** - Build vendor inventory - Define tiering criteria - Identify top 20 critical vendors **Days 31-60: Assessment** - Run critical/high assessments - Collect evidence and confirm certifications - Document risk acceptances **Days 61-90: Control** - Update contracts with security addendum - Build reassessment cadence - Launch governance reporting --- ## 10. Common pitfalls - Treating questionnaires as evidence - No linkage between procurement and security - Over-assessing low-risk vendors and ignoring critical ones - Missing subcontractor visibility - No defined remediation timelines --- ## Final Checklist (Quick Reference) - [ ] Vendor inventory is complete and owned - [ ] Tiering criteria are documented and approved - [ ] Critical vendors have evidence-based assessments - [ ] Contracts include security addendum and SLAs - [ ] Reassessment cadence is defined - [ ] Vendor incident response is tested If you need support building or accelerating a TPRM program, our team can help align your vendor risk model with NIS2, GDPR, and ISO 27001 requirements. --- ## Related Articles - [NIS2 Directive Compliance Guide](/en/insights/nis2-directive-compliance-guide) - [GDPR Compliance Checklist 2025](/en/insights/gdpr-compliance-checklist-2025) - [Incident Response Playbook](/en/insights/incident-response-playbook) ## Related Services - [NIS2 Compliance Consulting](/en/services/nis2-compliance) - [GDPR Compliance Consulting](/en/services/gdpr-compliance)