Your vendors hold your data, run your systems and connect to your network. Third-party risk management (TPRM) is how you decide which of them deserve a closer look, and how you keep watching them.
The checklist
- Inventory: one list of every vendor, its owner and the service it provides.
- Tiering: rate each vendor by data access, system access and business criticality.
- Due diligence: questionnaires and evidence (ISO 27001 certificate, SOC 2 report) scaled to the tier.
- Contracts: security, privacy, audit rights and breach notification clauses.
- Monitoring: annual reassessment for critical vendors and alerts for incidents.
- Offboarding: remove access and confirm data return or deletion when the contract ends.
Keep it proportionate
A stationery supplier and a payroll provider do not need the same review. Spend your effort where the data and access are.
Read the SOC 2 report, not just the cover page. Check the scope, the exceptions and the complementary user entity controls you are expected to run.
TEKGRC can design or run your TPRM programme. Let's connect.