Security · Cyber Assurance · 08
Third-party risk reviews
A third-party risk review assesses the organization’s whole population of suppliers, partners and service providers rather than one vendor at a time: who they are, what they touch, how each was assessed, what is monitored and where the concentration risk sits. It is needed when a regulator, auditor or customer asks how third parties are governed, when the vendor list has grown faster than the oversight of it, when a supplier incident has exposed a gap, or when a certification requires a documented third-party risk process. The review produces a complete third-party inventory with criticality tiers, an assessment of the current oversight process against the obligation that requires it, the vendors whose risk is unknown or unacceptable, and a program design that the organization can run without us.
Scope
What the review covers.
- Inventory of third parties with data, access and process-criticality classification
- Review of onboarding, assessment, contracting and offboarding practices
- Concentration and dependency analysis: single points of failure among suppliers
- Sampling of high-criticality vendors for evidence quality
- Alignment to the framework or regulation that requires third-party oversight
- Monitoring and re-assessment cadence
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Third-party inventory | Tiered by criticality, with owners |
| Program assessment | Current practice against the obligation, with gaps |
| Priority vendor list | Where risk is unknown or unacceptable, with next steps |
| Program design | Policy, workflow and templates the organization operates itself |
Prerequisites
What we need from you.
- Vendor and contract lists from procurement, finance and IT
- Existing third-party risk policy and assessment records, if any
- The obligation driving the review: regulation, certification, customer requirement
Related
Where this sits.
- Cyber Assurance Service
- Security Hub
- Security evidence preparation Also
- Security posture reviews Also
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
How is this different from a vendor security assessment?
A vendor assessment examines one supplier. A third-party risk review examines the population and the process that governs it.
We have hundreds of vendors. Is that feasible?
Yes. Tiering concentrates the effort on the vendors whose failure would matter; the rest are inventoried and monitored at a lighter level.
Will this satisfy an auditor?
The program design is built to the framework you are audited against and produces the records an auditor samples.