What Is Third-Party Risk?

Third-party risk is the exposure an organisation carries through the other organisations it depends on. It has grown to dominate many risk profiles, because the modern enterprise runs largely on services it does not operate.

The distinguishing feature is that the risk is real and the control is indirect. You can require, contract and verify; you cannot patch their systems or monitor their staff.

The forms it takes

Data risk — they hold your data, and their breach is your breach for notification purposes. Access risk — they hold credentials into your environment, so their compromise reaches you directly.

Availability risk — their outage stops your operation. Compliance risk — their failure creates your regulatory problem. Software risk — their code runs inside your systems. Each needs a different response, and programmes that treat them uniformly misallocate effort.

Concentration is the underrated dimension

Individual vendor assessment misses the aggregate picture. Several critical services resting on one cloud provider, one identity platform or one payment processor is a single point of failure that no per-vendor review surfaces.

The same applies at one remove: different vendors whose own infrastructure resolves to the same provider. Mapping that is harder and it is where systemic exposure actually lives.

Nth-party risk

Your vendors have vendors. A breach two or three relationships away can reach your data, and most organisations have no visibility beyond the first tier.

Full mapping is impractical. What is achievable is requiring disclosure of material subcontractors for critical relationships, and contractual obligations that flow the requirements down rather than stopping at your counterparty.

Exit is part of the risk

A vendor failing commercially, being acquired, discontinuing a product or terminating your contract all create the same problem: you need your data back and a route to an alternative.

That is worth establishing before signing. What format does the data come out in, how long does extraction take, does an alternative exist, and what does the contract say about assistance on termination. Answers obtained later are answers negotiated from a weak position.

What you can actually control

Not their security. You control what data they hold, what access they have, what the contract requires, whether you verify it, and what you would detect if their access were misused.

That last one is the most neglected and the most within reach. Monitoring third-party access as closely as privileged internal access is achievable unilaterally and requires nobody's cooperation.

Your customers are assessing you the same way

Any organisation selling to enterprises is somebody else’s third party, which means the questionnaires, evidence requests and contractual security terms flow in both directions.

That symmetry is useful. The controls that satisfy your customers’ diligence are largely the ones you would want anyway, and a maintained evidence package — a current attestation, a response library, a short controls summary — turns a recurring sales obstacle into a routine attachment.

Where to start

List your critical services and note which provider each ultimately depends on. Where several converge on one, that concentration is a risk no individual assessment reports.

See managing third-party risks and third-party remote access. GuardsArm runs security risk assessments.