Process of identifying, assessing, and managing security risks from vendors and partners.
Third-Party Risk Management (TPRM) addresses security risks from vendors, suppliers, and partners who access your systems or handle your data. TPRM includes vendor assessment (security questionnaires, audits), contractual requirements, ongoing monitoring, and incident response coordination. Supply chain attacks have highlighted third-party risk—your security depends on your vendors' security. Frameworks like ISO 27001 and NIST require third-party risk management.
Why It Matters
The DSC Perspective:
Your vendors can be your weakest link. Assess vendor security before engagement, include security requirements in contracts, and monitor vendor security ongoing. Supply chain attacks exploit trusted relationships.