Vendor & Third-Party Risk Management: The Complete Guide
Third-party risk management (TPRM) is the program for identifying, assessing, and continuously monitoring the security, privacy, and compliance risks your vendors introduce.
- Third-party involvement in breaches doubled to 30% (Verizon, 2025) — TPRM is now front-line security.
- Run it as a lifecycle, not an annual questionnaire.
- Tier vendors by risk so effort matches exposure.
- Add AI-specific due diligence for vendors with AI features and sub-processors.
The TPRM lifecycle
| Stage | What happens |
|---|---|
| 1. Inventory | Catalog vendors and the data/systems each can access |
| 2. Tier | Rank by risk (data sensitivity, criticality) |
| 3. Assess | Due diligence proportional to tier |
| 4. Contract | Security/privacy terms, DPAs, right to audit |
| 5. Monitor | Continuous signals on posture changes |
| 6. Offboard | Revoke access, confirm data return/deletion |
Tier by risk
Not every vendor needs the same scrutiny. Concentrate effort on vendors with access to sensitive data or critical systems; lightweight checks suffice for low-risk suppliers. Tiering is what makes a TPRM program scale.
From questionnaire to continuous monitoring
A point-in-time questionnaire describes a vendor’s posture on the day they answered — not the day they get breached. Modern programs supplement questionnaires with continuous monitoring of each critical vendor’s posture, so material changes surface between reviews. For the AI dimension of this shift, see our vendor risk in the age of AI article.
AI-era due diligence
When a vendor embeds AI, your data may flow through new models and sub-processors, creating “fourth-party” exposure and AI-governance obligations. Add these questions to critical-vendor reviews:
- What data does your AI feature process, and is any used to train models?
- Which foundation-model providers or sub-processors are involved?
- How do you govern your own AI (frameworks, human oversight, audit trail)?
- Can we opt out of AI features or data use?
- How will you notify us of material AI or sub-processor changes?
Metrics that matter
- Vendor coverage (share assessed and monitored)
- Concentration of high-tier vendors with critical access
- Time to detect a material vendor posture change
- Remediation/exception aging
Frequently asked questions
What is third-party risk management?
What are the stages of TPRM?
Why is third-party risk rising?
How often should you assess vendors?
See vendor risk run on your own data
Compyl unifies governance, risk, compliance and audit on one source of truth — built by CISOs, with a human approving every consequential decision.
About this guide. By Compyl Research, with data from the Verizon 2025 DBIR. Compyl is an AI-powered, agentic GRC platform built by CISOs that unifies vendor risk with the rest of your program.
