Skip to content
Clear Infosec

Governance & Compliance

What is Third-Party Risk Management?

Also known as: TPRM

Third-party risk management is the practice of identifying, assessing, and mitigating the security and compliance risks introduced by vendors, suppliers, and other external partners. It matters because organizations are increasingly breached through their supply chain, making a partner's weaknesses the organization's exposure.

Example

Before onboarding a cloud vendor, a company reviews the vendor's security certifications and contractually requires breach notification within a set timeframe.

Reference: NIST ↗

Related Clear Infosec services

IT GRC, TPRM & Audit PreparationRisk Assessment & Compliance Readiness

Related terms

Governance, Risk, and ComplianceRisk Assessment

Have a question about third-party risk management in your environment? Talk to our team.