Third-Party Risk Management
The practice of identifying, assessing, and controlling risks introduced by external vendors, suppliers, and service providers. Your security perimeter extends to everyone who touches your data.
Why it matters
Supply chain attacks are among the fastest-growing threat vectors. A single compromised vendor can expose your data, disrupt operations, or trigger regulatory consequences. NIS2 and DORA now explicitly require organizations to manage third-party risk. You cannot outsource a service and claim the risk went with it.
In practice
Third-party risk management involves maintaining a vendor inventory, assessing each vendor against risk criteria (data access, criticality, jurisdiction), monitoring ongoing compliance, and having exit strategies for high-risk relationships. In vucavoid, third parties carry dual scores for risk and reliability, with fourth-party visibility into your vendors' own supply chains. The assessment status feeds directly into your VUCA score.