TPRM (Third-Party Risk Management) is the practice of identifying, assessing, and continuously monitoring the risk that vendors, suppliers, contractors, and other outside parties introduce to an organization — mainly security, financial, operational, and compliance risk. It matters because a vendor's weak security can become your breach: in the 2013 Target breach, attackers got in using network credentials stolen from an HVAC/refrigeration vendor, exposing roughly 40 million payment cards. That single case is why TPRM is now a standing line item in most security and compliance programs, not an afterthought.
Why It Matters
Every vendor you connect to your systems, hand data to, or grant physical/network access to is effectively an extension of your attack surface — but one you don't fully control. Regulators have caught up to this: frameworks like ISO 27001 and SOC 2 both require organizations to show they're managing vendor risk, not just their own. Skipping TPRM doesn't remove the risk; it just means you find out about it during an incident instead of during a review.
The TPRM Lifecycle
1. Identify & Tier
Inventory every vendor with data access or system connectivity, then tier them by how much damage a failure would cause — a payroll processor gets more scrutiny than an office-supplies vendor.
2. Due Diligence
Send standardized questionnaires (like the SIG — Standardized Information Gathering — questionnaire), review certifications (SOC 2, ISO 27001), and check financial stability for critical vendors.
3. Contract & Onboard
Bake risk findings into the contract itself: security requirements, breach-notification timelines, right-to-audit clauses. Then provision access on a least-privilege basis.
4. Monitor Continuously
Risk doesn't freeze at signing. Re-assess on a schedule tied to tier, and watch for changes — a breach at the vendor, a dropped certification, a merger.
When the relationship ends, offboarding closes the loop: revoke access, retrieve or confirm deletion of data, and document that it happened. Skipping this step is a common audit finding on its own.
Common Frameworks & Tools
NIST 800-161 (Cybersecurity Supply Chain Risk Management) is the reference standard most GRC programs point to for third-party risk. In practice, teams also lean on the SIG questionnaire for consistent vendor assessments, a vendor risk register to track findings and remediation, and whatever industry-specific requirement applies — RBI outsourcing guidelines and DPDP Act obligations for vendors handling personal data are common ones for organizations operating in India.
Who Does This Work
Titles vary — Third-Party Risk Analyst, Vendor Risk Analyst, or just GRC Analyst with TPRM as one of several responsibilities. It usually sits inside the GRC or security risk function, working closely with procurement (who owns the commercial relationship) and legal (who owns the contract language). See what a GRC Analyst's day-to-day looks like for how TPRM work fits alongside the rest of the role, and try the Vendor Risk Challenge for a hands-on version of a due-diligence review.