Third-Party Risk (TPRM)

TPRM assesses the security of organisations you depend on — suppliers, partners, service providers. The questions are the same as for your own systems, but you cannot scan a third party's infrastructure, so the evidence comes from them.

What makes it different

Three things shape how TPRM works:

1. The vendor supplies the answers. You send a questionnaire; they respond with evidence. You are assessing their claims, not observing their systems.
2. Vendors log in themselves. Vendor users get restricted access — they see only their own assessments and nothing else in your NxSAM.
3. Effort should match exposure. A supplier handling customer data warrants far more scrutiny than one supplying stationery.

Pre-assessment: deciding how much scrutiny

Rather than sending every vendor the same long questionnaire, a short pre-assessment establishes what the relationship actually involves — what data they touch, what access they have, how critical they are.

That produces a tier, and the tier determines the depth of the full assessment. It keeps effort proportionate on both sides, and means a low-risk supplier is not asked to complete a two-hundred-question review.

The full assessment

The vendor register, with criticality and assessment state per supplier.

1. Create the audit from a template appropriate to the vendor's tier.
2. Invite the vendor. Their users receive access to their assessment only.
3. The vendor responds, answering controls and attaching evidence.
4. You review the responses — accepting, challenging, or asking for more.
5. Findings are raised where responses are inadequate.
6. Risks are recorded where gaps represent ongoing exposure.

Vendor users

Vendor users are external people with deliberately narrow access. They see their own assessments and nothing else — not your assets, not your findings, not other vendors.

Because they are external, their access needs managing as relationships change. A vendor user whose engagement has ended should be deactivated.

Reusing work across vendors

Vendors answering similar questionnaires give similar answers, and standards overlap heavily. TPRM includes support for identifying where a control in one framework matches a control in another, so an answer already given can be reused rather than re-collected.

This matters most when a vendor is assessed against several frameworks, or reassessed year after year — a great deal of what they told you last time remains true.

What good looks like

• Tier first, then assess. Pre-assessment before the full questionnaire keeps effort proportionate.
• Findings need owners on your side. A vendor gap is your exposure; someone internal has to decide what to do about it.
• Reassess on a cycle. A vendor assessed once three years ago is effectively unassessed.