Third-Party Risk Management, demystified

What third-party risk management actually is

Third-party risk management (TPRM) is the discipline of knowing which outside companies your business depends on, what could go wrong through each of them, and being able to prove you check. Every SaaS tool holding your data, every payment provider, every IT supplier is a door into your organization — and most companies run 50 to 200 of them while confidently estimating half that number.

TPRM stopped being optional the moment your customers, auditors and regulators started holding you accountable for your vendors’ failures. A processor leaks your data: the GDPR fine has your name on it. An ICT provider goes down: DORA asks why your resilience plan didn’t cover it.

What the frameworks expect from you

Each framework asks for vendor oversight in its own words, and an auditor will test each one:

• GDPR — Article 28 makes you responsible for choosing processors that offer “sufficient guarantees”: a DPA in place, sub-processors disclosed, transfers lawful.
• ISO 27001 — Annex A controls 5.19–5.23 require managing information security in supplier relationships, including monitoring, review and change management.
• SOC 2 — criterion CC9.2 expects you to assess and manage risks associated with vendors and business partners.
• NIS2 — Article 21 makes supply-chain security an explicit measure; you must assess the security of your direct suppliers.
• DORA — financial entities must keep a register of all ICT third-party providers, check contract provisions, and monitor concentration risk.

Different words, one requirement underneath: a living vendor inventory, a risk verdict per vendor with evidence behind it, and re-checks that actually happen.

The lifecycle — and where it breaks down

Textbook TPRM runs in six steps: inventory your vendors, tier them by criticality, assess each against your frameworks, fix the contract terms, monitor continuously, and offboard cleanly. In practice, most programs die at step five. The annual questionnaire goes out, half come back, and for the other 360 days of the year the risk posture is a guess. A vendor’s SOC 2 report expires, a sub-processor gets added, a breach hits the news — the spreadsheet doesn’t notice any of it.

How ZeroRisk runs it

ZeroRisk replaces the questionnaire cycle with continuous work. Every vendor is vetted clause by clause against the frameworks in your scope, and re-checked every 24 hours — certifications, breaches, sub-processor and policy changes. Findings arrive triaged with the remediation path drafted. And every verdict is signed by a person, so what lands in your audit file is an accountable conclusion, not a scraped score. Vendor risk is not an add-on module: it runs on the same platform, controls and evidence as your own certification readiness, on every plan.