Third-party risk review is the process of assessing the security, privacy, compliance, and operational exposure created by external vendors, partners, and service providers. In identity and security programs, it examines access to systems, handling of sensitive data, control maturity, contractual obligations, and the likelihood that a supplier could introduce or amplify risk.
What Third-Party Risk Review Actually Covers
Third-party risk review is broader than a vendor questionnaire. It looks at who the external party is, what systems and data it can reach, how that access is controlled, and whether the relationship creates a weak point in the organisation’s security, privacy, or resilience posture.
At its core, the review asks whether the supplier’s role is proportionate to the business need and whether the organisation can explain and defend that relationship to auditors, customers, and internal risk owners. That makes the term as much about governance and accountability as about technical security.
Why Third-Party Relationships Increase Exposure
External providers often sit inside trust paths that are difficult to see from the inside. They may hold tokens, API keys, certificates, support access, integration privileges, or data processing authority that can be abused if the vendor is compromised or misconfigured. When those controls fail, the downstream impact can look like a direct breach even if the attacker never touched the organisation’s own perimeter.
Third-party risk also accumulates because suppliers are rarely isolated. A single provider may support authentication, remote administration, analytics, customer support, or software delivery, so one weak relationship can affect multiple systems at once. That is why a meaningful review examines concentration risk, not just contract language.
What a Meaningful Review Examines
A useful third-party risk review checks the practical surfaces of exposure: access paths, data sensitivity, subprocessor use, incident handling, logging, retention, and offboarding. It also asks whether the vendor’s controls are actually measurable, or whether the organisation is relying on assurances that cannot be independently verified.
The strongest reviews connect security review to real-world failure modes, such as token theft, delegated access abuse, insecure integrations, and poor credential hygiene. Internal incident write-ups such as BeyondTrust breach 2024, Klue OAuth Supply Chain Breach, and Slack GitHub breach 2022 show how third-party access can become a direct path to sensitive systems and repositories.
How Organisations Use Third-Party Risk Review in Practice
In practice, the review becomes a decision point for onboarding, renewal, and ongoing monitoring. It helps determine whether a vendor can be trusted with production access, sensitive records, regulated data, or administrative privileges, and whether extra controls are needed before the relationship goes live.
That usually means translating vendor promises into enforceable requirements: clear ownership, scoped access, strong authentication, timely offboarding, breach notification expectations, and evidence that the supplier can revoke or rotate access quickly when something goes wrong. Guidance such as EU Digital Operational Resilience Act (DORA) and the SOC 2 Trust Services Criteria (AICPA) are often used to structure those expectations, while the review itself tests whether the supplier can actually meet them.
Risk and Threat Considerations
Third-party risk review matters because vendor compromise often bypasses the controls an organisation expects to protect its own environment. A supplier with excessive privileges, weak authentication, or poor token hygiene can become an attacker’s easiest route into data, support systems, or administrative workflows.
Failure mechanism: The risk emerges when external access is broader or longer-lived than it needs to be, or when a supplier’s own security failures are inherited by the customer through integrations, delegated access, or shared credentials.
Impact: The result can include data exposure, service disruption, privilege abuse, regulatory findings, and incident response work that is harder to contain because the compromised path originated outside the organisation’s direct control.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CSA Cloud Controls Matrix, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while DORA defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity & Access Management | Third-party review hinges on external access, entitlement scope, and vendor identity governance. |
| Recommendation — Review vendor identities and entitlements before granting access, then revalidate them on a set schedule. | ||
| NIST SP 800-53 Rev 5 | SA-9 — External System Services | This control directly governs security expectations for services provided by external parties. |
| SR-6 — Supplier Assessments and Reviews | Supplier review is the control concept most directly tied to assessing third-party risk over time. | |
| Recommendation — Specify security requirements, monitoring, and responsibilities for external system services in contracts. Perform recurring supplier assessments and track remediation for gaps that affect your risk posture. | ||
| NIST CSF 2.0 | GV.SC-01 — Cyber Supply Chain Risk Management Strategy | Third-party risk review is a supply-chain governance activity that requires a defined strategy. |
| Recommendation — Establish a supply-chain risk strategy that defines how vendors are assessed, approved, and monitored. | ||
| DORA | ICT third-party risk management — ICT Third-Party Risk Management | DORA directly governs oversight of external ICT providers and their operational resilience obligations. |
| Recommendation — Contractually require resilience, access, and incident-handling obligations from ICT providers. | ||
Practitioner Guidance
Why practitioners should care: A third-party review should not be treated as a procurement checkbox. It is a control decision about which external relationships are allowed to hold trust, access, or sensitive data on the organisation’s behalf.
Common misunderstanding: A clean questionnaire does not prove low risk. Practitioners should look for evidence of operational control, especially around access revocation, incident notification, and the supplier’s ability to prove what was exposed if something fails.
Practitioner takeaway: The most useful reviews focus on the exact privilege the vendor has today, not the assurances it gave at onboarding.
Related resources from NHI Mgmt Group
- How should universities review third-party identity risk?
- How should GRC teams automate vendor tiering in third-party risk management without relying on manual review?
- What should organisations do when they adopt third-party AI tools without a clear risk review?
- What is the difference between third-party risk management and a one-time vendor review?