Interagency Guidance on Third-Party Relationships

What has changed, however, is the frequency and scale of third-party use and the regulatory focus on how organizations are managing third parties to address the inherent risks. The use of third parties is nothing new — companies have worked with suppliers, outsourcers, licensees, agents, and the like for years. Automate data protection, threat detection and compliance to secure your enterprise across cloud and on‑premises environments. Protect your most critical data—discover, monitor and secure sensitive information across environments while automating compliance and reducing risk. It also shows how to reduce risk and manage the governance process to achieve AI trust for all AI use cases in your organization.

Technology and RegTech solutions now enable continuous monitoring of cyber posture, financial health, and sanctions exposure. For example, if sustainability is a board priority, relevant obligations should be hardwired into supplier contracts. For procurement teams, the framework ensures these requirements https://praisetabernacle.info/how-to-calculate-batting-average-formula are consistently built into template contracts, avoiding uneven application. While a policy sets the rules, the framework shows how those rules are applied in practice.

• While it may be growing in popularity, third-party risk management is still an underused strategy for many businesses.
• This level of engagement and the valuable ecosystem created by and for our customers enables Bitsight to provide more accurate and refined security ratings.
• Below are many of the most common risks to be aware of as you build out a third-party risk management program.
• Integrate TPRM with procurement and legal.
• The TPRM lifecycle begins with recognizing potential risks and continues through continuous monitoring.

Supervisors expect firms to map their approach directly to published requirements, whether it is the FCA and PRA’s outsourcing and third-party risk guidance, DORA in the EU, or interagency statements in the US. It sets the boundaries of accountability, translates regulatory requirements into clear standards, and ensures that oversight is applied consistently across suppliers, vendors, and outsourcing arrangements. A third-party risk management policy defines how an organisation governs the external partners it relies on for critical services and operations.

• The centralized approach also improved accountability, adjusted easily to regulatory changes and brought clarity to the entire TPRM lifecycle.
• With the advent of the cloud, virtual data centers, and hosted apps, companies are using vendors to process their critical business information, thus transferring data outside their firewalls.
• Many regulations firmly put responsibility for third-party compliance with the company that employs them, making understanding and complying with third-party risk management regulations a necessity rather than a nice-to-do.
• Pay attention to critical clauses—especially those that outline compliance, data protection, and risk mitigation responsibilities.

What are some emerging trends and insights on third-party risk management?

Stakeholders increasingly want visibility of how third-party risks are managed. Embedding psychological safety into culture — where staff know their concerns will be taken seriously — is critical to ensuring third-party risks are escalated in time to prevent incidents. A third-party risk management policy is only credible if it can be measured and https://www.motonlegalgroup.com/technology-law-firms/ assured. A well-structured third-party risk managementpolicy should be concise, practical, and aligned with regulatory expectations. Malware was deployed on point-of-sale devices, exposing over 40 million payment cards and costing the company hundreds of millions of dollars in settlements and remediation.

Success requires executive buy-in, cross-functional collaboration between security, procurement, legal, and business units, clear policies, and enabling technology. Emerging threats in 2026 include AI-powered attacks targeting vendor ecosystems, supply chain attacks exploiting trusted relationships, and deepfakes used in vendor impersonation schemes. Reputational risk results from vendor misconduct, data breaches, or unethical practices that damage your brand by association—customers and regulators hold you responsible for your vendors’ actions regardless of contractual boundaries. Compliance risk arises when vendors fail to meet regulatory requirements like GDPR, HIPAA, PCI DSS, or SOC 2—exposing your organization to fines and legal liability even though the violation happened entirely within their infrastructure. Cybersecurity risk shows up through vulnerabilities in vendor systems, weak access controls, lack of encryption, and susceptibility to ransomware. In the US, SEC cybersecurity rules mandate that public companies disclose third-party cybersecurity risks, while NYDFS requires financial services firms to conduct due diligence on critical service providers.

In today’s interconnected business ecosystem, your security is only as strong as your third-party relationships. Additionally, Hyperproof offers a third-party Vendor Management module that allows you to easily assess your vendors’ security and compliance posture and manage third-party risk. That foundation is critical for mature, repeatable cybersecurity third party risk management. Hyperproof is a compliance operations application that provides a central, secure place for an organization to maintain compliance against well-accepted cybersecurity frameworks such as NIST Cybersecurity Framework and ISO 27001. As demand and urgency to manage third-party risk continues to grow, organizations will need to find the right tools to help them manage the complexity and keep costs in check.

The following are eight of the most common third-party risk categories organizations should assess. A customer support provider, for example, may introduce privacy and operational risks, while a cloud infrastructure provider may create security, compliance, and concentration risks. Organizations must understand a much broader set of risks that can affect business continuity, regulatory compliance, customer trust, and operational performance. Historically, organizations focused primarily on information security risks when evaluating vendors.