Third-party risk
A supplier relationship can introduce security and resilience dependencies.
The idea
Third-party risk concerns services, data handling, and access involving external providers. Assess criticality, shared responsibilities, permissions, assurance evidence, incident communication, and continuity arrangements. Due diligence should be proportional to the relationship and followed by ongoing review. Contracts can establish obligations but do not by themselves demonstrate performance. Plan for changes, outages, and termination of access or data processing.
In practice
A hosted service holds important records. The organization reviews access, incident notification, recovery options, and export capability before becoming dependent on it.
A common misunderstanding
A reputable provider does not remove the customer’s responsibility to configure and govern its own use.
Check your understanding
Why plan an exit before adopting a service?
Think it through: It helps avoid losing access to essential data or operations if the relationship ends or the service changes.
Understand the dependency you are creating
A supplier can introduce risk through data access, privileged connectivity, software, service availability, or a dependency that is difficult to replace. Evaluate the relationship's role rather than applying the same questionnaire to every vendor. A public brochure designer and a provider hosting assessment records create very different consequences if something goes wrong.
Start with the intended use, data involved, access granted, and business dependence. Consider onboarding, ongoing monitoring, incident communication, and exit. A security certification or questionnaire response can inform the assessment, but it does not automatically cover every service, location, or configuration used by the customer. Check the scope of any assurance claim.
A fictional teaching-platform supplier
An academy chooses a hosted service for live classes. The review considers account administration, recordings, support access, availability, export options, and what happens if the contract ends. A trial demonstrates teaching features, while separate questions establish whether important records can be exported in a usable form.
The contract and operating relationship should clarify responsibilities. If an incident occurs, the academy needs a route to obtain relevant information and coordinate action. If the service becomes unavailable, an alternative teaching arrangement may matter more immediately than a lengthy supplier questionnaire. Risk review should connect protection and resilience to actual use.
Trace the exit path
For a fictional cloud note-taking service, list what information it holds, who can administer it, and what work depends on it. Then describe how the organization would retrieve its information and remove access at the end of the relationship. Identify one fact that must be verified with the supplier rather than assumed from marketing language.
Keep exploring
References & further reading
Original explanations, with primary references for deeper study.
NIST: Guide for Conducting Risk Assessments