[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Vendor Risk Management](/category/vendor-risk-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [What Is a Third-Party Risk Assessment? Definition, Process, and Examples](/blog/what-is-a-third-party-risk-assessment) Publish date October 18, 2026 {x} minute read # What Is a Third-Party Risk Assessment? Definition, Process, and Examples [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](#) [Free trial](/demo) Written by [Cassy van Eeden](/team/cassy-van-eeden) Content Writer Cassy is a Content Writer at UpGuard with a background in B2B SaaS and tech writing. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents Free resource ### [Download now](#) Your vendor list grows faster than your team can review it, and last year's questionnaire answers go stale fast. A third-party risk assessment lets you find which outside companies could expose your data or disrupt your operations, so you know where to focus. Your vendors feel the same strain, since many of them field near-identical questionnaires from every customer. That volume slows their responses and invites copy-and-paste answers that say little about current controls. ## Third-party risk assessment, defined  A third-party risk assessment examines each outside relationship before you sign and throughout the contract. It weighs the third party's security controls, the data and systems it can reach, and how much your business depends on it.  Vendors and suppliers get most of the attention, but the review applies to any partner that handles your sensitive data or touches your systems. What you learn decides how much scrutiny, contract protection, and monitoring each relationship gets.  A point-in-time assessment is only as current as the evidence behind it. A vendor that passed review in March can change by June, so findings should feed ongoing oversight instead of ending as a filed report. ## Why third-party risk assessments matter Your attack surface extends into every vendor that stores your data or connects to your systems. When one of those vendors suffers a breach or a supply chain attack, the fallout often reaches your customers and your own compliance obligations. Third-party risk management (TPRM) programs exist to manage that exposure, but they depend on inputs you can trust.  Confidence is scarce, and the [2026 KPMG Global TPRM Survey](https://kpmg.com/xx/en/our-insights/risk-and-regulation/the-2026-kpmg-global-third-party-risk-management-survey.html) of 851 organizations found only 15% of leaders have high confidence in their data. KPMG recommends focusing on the small group of third parties that pose material threats, and a tiered assessment program puts that advice into practice. Regulators also expect documented, risk-based oversight of outside providers. These frameworks set the most common expectations: * **Digital Operational Resilience Act:** Article 28 of [Regulation (EU) 2022/2554](https://eur-lex.europa.eu/eli/reg/2022/2554/oj) requires EU financial entities to manage risk from their technology providers and keep a register of information on those contracts. * **NIS2 Directive:** Article 21 of [Directive (EU) 2022/2555](https://eur-lex.europa.eu/eli/dir/2022/2555/oj) requires essential and important EU entities to address supply chain security, including security aspects of their relationships with direct suppliers. * **New York State Department of Financial Services Part 500:** [Section 500.11](https://www.law.cornell.edu/regulations/new-york/23-NYCRR-500.11) requires policies for identifying and periodically assessing third-party service providers. * **Interagency guidance on third-party relationships (2023): **[US banking regulators](https://www.govinfo.gov/content/pkg/FR-2023-06-09/html/2023-12340.htm) set risk-based expectations across the life of each relationship. A documented assessment gives you defensible evidence for audits and [board reporting on TPRM performance](https://www.upguard.com/blog/kpis-to-measure-tprm). It shows what you reviewed and why you accepted the remaining risk. ## Third-party risk assessment vs vendor risk assessment A third-party risk assessment covers every outside relationship, including contractors and affiliates, plus the open-source code your software depends on. A [vendor risk assessment](https://www.upguard.com/blog/vendor-risk-assessment) is the narrower subset focused on companies you buy products or services from.  Both happen in the assessment stage of the TPRM lifecycle, and you can often use the same questionnaires and scoring models. The table below compares the two side by side: | Attribute | Third-party risk assessment | Vendor risk assessment | | -------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------- | | Scope | All outside relationships, including partners and open-source dependencies | Companies that sell you products or services | | Typical owner | TPRM or enterprise risk team | Security or procurement team | | Typical inputs | Questionnaires, outside-in scans, contracts, and partner due diligence | Security questionnaires, certifications, and outside-in scans | ## What a third-party risk assessment includes A complete assessment tells you how much risk a relationship carries and whether the third party's controls bring it to an acceptable level. Most third-party risk assessments include these components: * **Scope and inherent risk profile:** What the third party does for you, and the data and systems it can reach. * **Security controls evidence:** Answers to a [vendor questionnaire](https://www.upguard.com/blog/vendor-risk-assessment-questionnaire-template) and independent proof such as SOC 2 Type II reports and ISO 27001 certificates. * **External security posture:** Outside-in scanning and [security ratings](https://www.upguard.com/blog/what-are-security-ratings) that test questionnaire claims against what's visible from the internet. * **Compliance and contractual obligations:** Data processing terms and breach notification clauses that make the vendor's commitments enforceable. * **Risk findings and remediation plan:** Rate each gap by severity, with an owner and a deadline for the fix. * **Residual risk decision:** Your formal call on the risk that remains after controls, and the date of the next review. Inherent risk is the exposure a relationship carries before controls, while residual risk is what's left after them. Outside-in evidence keeps questionnaire answers honest, since a vendor claiming strong patching shouldn't show outdated, exposed services from the outside. ## Examples of third-party risk Third-party risk appears in several forms, and a thorough assessment checks for each one. The incidents below come from public investigations and show what each risk type looks like. ### Cybersecurity risk Attackers often reach your data through a vendor relationship, using stolen credentials or compromised software updates. [Mandiant's investigation](https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion) of the 2024 Snowflake customer data thefts traced every incident it handled to compromised customer credentials. Mandiant found no evidence of a breach of Snowflake's own environment. The weak point sat between each customer and the platform, so your assessment should cover shared responsibility. Ask how the vendor enforces multi-factor authentication and which credential controls your own team owns. ### Operational risk A critical provider can halt your operations with no attacker involved. [CrowdStrike's root cause analysis](https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf) traces the July 2024 outage to a faulty content update. A mismatch in the number of input parameters the sensor expected caused the failure. Outages like that one fall under business continuity and concentration risk. Ask critical vendors how they stage and roll back updates, and check whether your recovery plans account for their failure. ### Compliance and regulatory risk A vendor's mishandling of regulated data can become your violation, because many laws hold you accountable for the providers you choose. Under Article 28 of the [GDPR](https://eur-lex.europa.eu/eli/reg/2016/679/oj), you must use only processors that offer sufficient guarantees and govern their processing by contract. In US healthcare, vendors that handle protected health information fall under HIPAA. After the 2024 Change Healthcare cyberattack, the [Office for Civil Rights at the Department of Health and Human Services](https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html) opened investigations into Change Healthcare and its parent, UnitedHealth Group. It also reminded covered entities of their HIPAA obligations to have business associate agreements in place. ### Financial and reputational risk A vendor in financial trouble may cut security spending or shut down with your data still on its servers. Assessments of critical vendors often include financial health checks, such as credit reports or audited statements, along with an exit plan. Reputational damage follows a different path, because customers rarely separate your brand from a partner's failure. If a vendor leaks your customer data, the notification letters usually carry your name. ### Fourth-party risk Your vendors depend on their own providers, and those dependencies become your exposure. The European Union Agency for Cybersecurity documents a September 2025 ransomware incident at Collins Aerospace in its [Threat Landscape 2026 report](https://www.enisa.europa.eu/sites/default/files/2026-09/ENISA%20Threat%20Landscape%202026_Final.pdf).  The attack hit the company's passenger-processing software and disrupted automated check-in at several EU airports, including Brussels and Berlin. For the airlines operating at those airports, Collins Aerospace was a fourth party: their vendor’s vendor. Ask critical vendors to name their [key subcontractors](https://www.upguard.com/blog/what-is-fourth-party-risk) so you can spot concentration on shared providers such as cloud hosting. > *Asking only works for the subcontractors a vendor chooses to name. *[*UpGuard Vendor Risk*](https://www.upguard.com/product/vendor-risk)* maps fourth-party connections automatically, so shared dependencies and concentration risk across your vendor portfolio show up in one view.* The table below summarizes each risk type and the evidence an assessment typically gathers for it: | Risk type | What it looks like | Typical assessment evidence | | -------------------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------ | | Cybersecurity | Stolen credentials or compromised updates expose your data | Security questionnaire, SOC 2 report, and external scans | | Operational | A provider outage halts your operations | Business continuity plan, update and rollback practices | | Compliance and regulatory | A vendor mishandles regulated data | GDPR data processing agreement, HIPAA business associate agreement | | Financial and reputational | A vendor fails financially, or a partner incident damages your brand | Financial statements, exit plan | | Fourth-party | A shared provider fails across many vendors | Subcontractor list, concentration analysis | ## The third-party risk assessment process In the UpGuard TPRM lifecycle, assessments follow discovery and onboarding, then feed into ongoing risk management and continuous monitoring.  A common scoring method comes from NIST [SP 800-30](https://csrc.nist.gov/pubs/sp/800/30/r1/final), which rates risk by likelihood and impact. 1. **Inventory your third parties:** List every outside company with access to your data or systems, including shadow vendors that procurement never processed. Expense reports and single sign-on logs often reveal them. 2. **Tier by inherent risk:** Use [vendor tiering](https://www.upguard.com/blog/what-is-vendor-tiering) to rank each third party by the data and systems it can reach and how much you depend on it. That tier sets the depth of every later step. 3. **Collect evidence:** Send questionnaires that match the vendor’s tier and request supporting documents such as audit reports. Pull outside-in scan results at the same time. 4. **Analyze and score:** Rate each finding by likelihood and impact, following NIST 800-30, then check questionnaire claims against the security posture you can observe externally. 5. **Remediate and decide:** Assign each finding an owner and a deadline, then track fixes to closure. Record the residual risk decision and who approved it. 6. **Monitor and reassess:** Continuous monitoring re-scores vendors as their external posture changes, giving you a current view between reviews. Reassess on a cadence your tiering sets, or sooner after a significant change. Evidence collection usually takes the most analyst time, so an accurate tier in step two saves effort in every step after it. > *Some of that collection can happen before you ask. UpGuard maintains thousands of pre-sourced evidence documents for most monitored vendors, and pre-fills 49% of NIST CSF 2.0 checks and 46% of ISO 27001:2022 checks for the 100 most monitored vendors. Uploading a single SOC 2 report can complete *[*61% of NIST CSF or ISO 27001 risk assessments*](https://www.upguard.com/product/vendor-risk/ai)*, cutting the follow-up questionnaire from 241 questions to 94.* ## How to keep third-party risk assessments manageable Assessment volume tends to grow faster than headcount, making understaffing a major issue. Fixing it starts with knowing where the strain comes from, then changing how you assign depth and evidence. ### Why assessments feel overwhelming Practitioners on both sides of the questionnaire describe the same frustration. In one [Reddit cybersecurity thread](https://www.reddit.com/r/cybersecurity/comments/1kfwkfr/dealing_with_the_overwhelming_3rd_party_risk/), a practitioner described a four-person team at a midsize company responding to risk assessments from around 100 corporate clients. Security teams on the sending side feel it too, because every slow response delays their review. Duplicate questionnaires drive much of the load, and the [EY 2025 Global TPRM Survey](https://www.ey.com/content/dam/ey-unified-site/ey-com/en-gl/services/consulting/documents/ey-gl-2025-ey-global-third-party-risk-management-survey-05-2025.pdf) found 43% of large companies use multiple questionnaires across risk domains.  Organizations in the survey, all with $250 million or more in revenue, send third parties an average of 55 questionnaires. Add one-size-fits-all depth and manual follow-up, and both sides spend hours on relationships that carry little risk. ### Match assessment depth to vendor tier Assessing every vendor at the same depth makes coverage worse, because low-risk relationships spread analyst hours thin. Depth should follow the vendor’s tier, with outside-in data doing the first pass so analysts spend their time where risk is real. The table below shows a sample mapping of tiers to assessment depth that you can adjust to your own risk appetite: | Tier | Typical profile | Assessment depth | Reassessment cadence | | -------- | ------------------------------------------------ | ----------------------------------------------------------- | ---------------------------------------- | | Critical | Holds sensitive data or supports core operations | Full questionnaire with evidence review and outside-in scan | Annually, plus after significant changes | | Medium | Limited data or system access | Short-form questionnaire plus outside-in scan | Every two years | | Low | No sensitive data or system access | Outside-in review only | At contract renewal | ### Use continuous monitoring between assessments Continuous monitoring scans each vendor's external footprint on an ongoing basis and updates its security rating as conditions change. It catches events such as expired certificates, newly exposed services, and public breach disclosures. Set alerts so a meaningful drop in a vendor's rating triggers an early reassessment. Your annual review then becomes a scheduled check-in, while ongoing signals cover what happens in between. ## How UpGuard helps you assess third-party risk [UpGuard Vendor Risk](https://www.upguard.com/product/vendor-risk) combines security ratings from continuous outside-in scanning with questionnaire automation and AI evidence analysis. You can tier vendors by inherent risk and route each tier into workflows that set the right assessment depth. When a vendor shares a SOC 2 report or completed questionnaire, evidence analysis helps you find gaps without reading every page by hand. Security ratings update as the vendor's external posture changes, so you see new issues between reviews. [Trust Exchange](https://www.upguard.com/product/trust-exchange) works from the vendor side, letting your vendors share their security posture proactively in a Trust Center. Sharing once cuts duplicate questionnaires and the time you spend waiting for responses. > [*St John Western Australia*](https://www.upguard.com/customers/st-john-wa)* reports saving around 2,000 hours of assessment time with Vendor Risk, roughly two people’s work a year. Andrew Bullen, Manager of IT Security and Governance, said: “Third-party assessments could take up to 20 to 80 hours per vendor. With hundreds of vendors, it would take a team of two a full year to assess them all.”* To see how UpGuard Vendor Risk fits your program and accelerates third-party risk assessments, [start a free trial](https://www.upguard.com/demo). ## Frequently asked questions ### What should a third-party risk assessment include? Start with the third party's inherent risk and evidence of its security controls, then verify that evidence against its external posture. Finish with contract terms and a residual risk decision that names remediation owners. ### Who is responsible for third-party risk management? A security or risk team usually runs the program, but the business owner of each relationship stays accountable for its risk. Mature programs name one TPRM owner and give legal and compliance teams defined review roles. ### How often should you perform a third-party risk assessment? Base the schedule on tier, reassessing critical vendors most often and lower tiers less often. Trigger an early review when a vendor's posture or ownership changes. ### What is the difference between TPRM and a third-party risk assessment? TPRM is the [full program](https://www.upguard.com/category/third-party-risk-management) that governs third parties from discovery through offboarding. The assessment is one activity inside it, where you evaluate a specific relationship at a specific point. ### What is a third-party risk assessment questionnaire? It's a structured set of questions a third party answers about its security policies and controls, often based on the SIG or CAIQ. Its answers carry the most weight when you verify them against documents and outside-in data. Free resource ### [Download now](#) ## Related posts Learn more about the latest issues in cybersecurity. Third-Party Risk Management #### [The Evidence Is In: UpGuard Named a Leader in the IDC MarketScape for Worldwide Third-Party Risk Management](/blog/upguard-named-leader-in-idc-marketscape) UpGuard has been named a Leader in the IDC MarketScape: Worldwide Third-Party Risk Management Services 2026 Vendor Assessment. Find out why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 18, 2026 Third-Party Risk Management #### [We Researched Four AI Evidence Analysis Tools for TPRM. Here’s What We Found.](/blog/ai-evidence-analysis-tools-for-tprm) We researched four AI evidence-parsing tools against four criteria that security teams often overlook. None nailed all four. [](/team/cassy-van-eeden) [Cassy van Eeden](#) September 29, 2026 Third-Party Risk Management #### [The Vendor Assurance Confidence Gap: Why It’s Widest With Your Most Critical Vendors](/blog/vendor-assurance-confidence-gap) Vendor assurance efforts are rising while confidence in them is falling. This gap is widest with the vendors that matter most. Here’s why. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 25, 2026 Third-Party Risk Management #### [Higher Education TPRM in 2026: New Research Maps the Vendor Visibility Gap](/blog/higher-education-tprm-2026) Explore UpGuard’s latest research into higher education third-party risk, including supplier concentration and systemic vendor exposure. [](/team/cassy-van-eeden) [Cassy van Eeden](#) August 10, 2026 Vendor Risk Management #### [Vendor Tiering That Scales: A Weighted-Model Implementation Guide](/blog/vendor-tiering-that-scales) UpGuard's guide to vendor tiering at scale: a weighted risk model that tiers vendors objectively and routes high-risk vendors for review automatically. [](/team/cassy-van-eeden) [Cassy van Eeden](#) October 13, 2026 Vendor Risk Management #### [The Vendor Tiering Series: Why Tier Your Vendors](/blog/vendor-tiering-why-tier-vendors) When every vendor is a priority, none actually are. Learn how effective vendor tiering defines criticality and maintains a defensible security posture. [](/team/revashni-moodley) [Revashni Moodley](#) February 25, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)