Third-Party Risk Management: Building a Supplier Security Programme

Third-party risk management (TPRM) is the programme an organisation uses to identify, assess, contract with, monitor and exit the suppliers and partners that could affect its security, compliance or operations. It runs for the whole life of each relationship. A one-off questionnaire at onboarding is a single step, not a programme.

Most organisations now rely on cloud platforms, SaaS tools, managed service providers and payment processors that hold their data or run their services. Regulators and auditors therefore ask the same question in different words: do you know who your critical suppliers are, and can you show how you control the risk they bring?

This guide covers the programme. For the assessment step itself, including a supplier questionnaire, see our vendor risk assessment guide.

What is third-party risk management?

Third-party risk management is the work of controlling risk that sits outside your organisation but can still hurt it. A “third party” is any external organisation you share data, systems or services with: suppliers, outsourcers, cloud and software providers, data processors, agents and introducers. Their own subcontractors are often called fourth or nth parties.

Third-party risk takes several forms, and a good programme looks at all of them:

TPRM overlaps with supply chain security, which focuses on attacks that come through suppliers and software, such as compromised updates or dependencies. TPRM is the governance wrapper around that technical work.

What is a third-party risk management framework?

A third-party risk management framework is the policy, roles and lifecycle that make supplier oversight consistent. Most frameworks follow the same six stages.

How do the six stages map to the five phases of third-party risk management?

Many guides, including the 2023 interagency guidance from the US banking regulators, describe a five-phase life cycle. The stages are the same work, divided differently:

We split planning in two because most UK organisations start without a complete supplier list, and tiering is the step that decides how much effort every later phase gets.

How should you tier suppliers?

Tiering decides how much effort each supplier gets. Without it, teams either send the same long questionnaire to everyone or check no one properly. A simple three-tier model works for most organisations:

Which regulations require third-party risk management?

Several UK and EU rules require TPRM, and most organisations fall under more than one. The detail differs, but the lifecycle above covers all of them.

In UK financial services, third-party risk is also central to operational resilience: firms must map the suppliers behind each important business service. The Critical Third Parties regime adds direct regulatory oversight of designated providers but leaves each firm accountable for its own arrangements. For the EU detail, see our guide to DORA regulation. Outside financial services, the UK Cyber Security and Resilience Bill, still before Parliament, would let regulators designate critical suppliers to essential services and bring them under the NIS regime.

Who is responsible for third-party risk?

The organisation that uses the supplier stays accountable. DORA says financial entities remain fully responsible for compliance when they use ICT third parties, and the UK regulators say the same about outsourcing. Inside the organisation, responsibilities are usually split like this:

What evidence should you ask suppliers for?

Ask for evidence that matches the supplier’s tier: typically a PCI DSS Attestation of Compliance from payment service providers, a Cyber Essentials or Cyber Essentials Plus certificate (confirm it with our Cyber Essentials certificate check), an ISO 27001 certificate whose scope covers the service you buy, and a recent penetration test summary. Our vendor risk assessment guide has the questionnaire template and explains how to verify each document.

How do you monitor third parties after onboarding?

Monitoring is where most programmes fail, because the onboarding file goes out of date. Set a review calendar by tier, and act on events between reviews:

External security ratings services can add early warning signals, but they see only what is visible from the internet. Treat them as a supplement to evidence, not a substitute.

How do you start a TPRM programme from scratch?

Start small and focus on the suppliers that matter most:

1. Build the list. Pull suppliers from accounts payable, then check single sign-on and expense data for SaaS tools bought outside procurement.
2. Tier everyone. A short intake form with five or six questions about data, access and criticality is enough to start.
3. Assess critical suppliers first. Collect evidence and record a risk decision for each.
4. Fix contracts at renewal. Agree a standard security schedule and add it as contracts come up.
5. Set the calendar. Put review dates and certificate expiries where someone will see them.
6. Report. Give the board a short, regular view of critical suppliers, open risks and exceptions.

Why Sovereign Secure

This guide is for teams running their own programme. Where we fit is the evidence and controls that programme depends on:

• If you are building the programme: our ISO 27001 consultancy builds supplier controls 5.19 to 5.23 into your ISMS, and we are ISO 27001 certified ourselves. Certification audits are carried out by our partner certification body, MQA International. We also penetration test the integrations, APIs and remote access routes that connect suppliers to your systems.
• If you are the supplier being assessed: as a PCI SSC Qualified Security Assessor (QSA) company we assess service providers whose customers need an Attestation of Compliance under Requirement 12.8.4, and as an IASME-licensed certification body we issue Cyber Essentials and Cyber Essentials Plus certificates. We are also a Qualified PIN Assessor, a Card Production Security Assessor and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028.

Sovereign Secure Ltd was founded in 2012, with its head office in Accrington, Lancashire, and offices in Los Angeles, Singapore, Dubai and Dhaka.

Need supplier evidence or supplier controls?

If a customer has asked you for an Attestation of Compliance, a Cyber Essentials certificate or a penetration test report, or you are building supplier controls into an ISMS, get in touch or call +44 161 523 5276.