Most third-party risk reports tell the board how many questionnaires were sent, not whether the organisation is more or less exposed to its suppliers than it was last quarter. Directors need a short set of indicators that move when exposure changes: critical services resting on one provider, suppliers operating above the agreed risk tolerance, new critical arrangements signed before anyone assessed them, and supplier incidents that start a regulator's clock. This guide sets out ten board-level key risk indicators (KRIs) and four supporting key performance indicators (KPIs) for vendor risk, with formulas, tolerance bands, the appetite statement each one tests and the decision each one should trigger. It is written for TPRM leads, CISOs, chief risk officers and company secretaries preparing the board or risk committee pack. Running the programme day to day is covered by the TPRM Programme Health Check; this page reports outcomes upward and shares only two measures with it.
Key takeaways
- Tie every KRI to one appetite sentence. If a measure does not test something the board decided, it belongs in the management pack, not the board pack.
- Concentration is the board's question. Report how many critical services depend on one provider, or on several providers that share one fourth party, because that is where a single failure becomes an outage across the business.
- Show trend, not a snapshot. Four quarters of direction tells directors whether the exposure is being worked down; a single green number tells them nothing.
- Regulators already expect this reporting. DORA Article 5(2) requires reporting channels to the management body on ICT third-party arrangements, and the US interagency guidance asks for periodic board reporting that includes dependency on a single provider.
- Supplier credentials are a risk indicator. Standing integration tokens and keys that suppliers hold into your core systems are an exposure the board can understand, and they turn a supplier breach into your breach.
KPIs versus KRIs for third-party risk
A KPI shows whether a TPRM activity is performing; a KRI shows whether exposure to a supplier risk is approaching or past the tolerance the board agreed. The general method is set out in the Key Risk Indicators for Cyber Risk Guide. Third-party programmes produce a lot of activity data (assessments sent, scores received, contracts reviewed), and all of it can be green while the business quietly moves more of its critical services onto fewer providers.
| Question | KPI (management) | KRI (board) |
|---|---|---|
| Measures | Throughput and control performance | Exposure against tolerance |
| Example | Median days to complete due diligence on a critical supplier | Critical business services relying on a single provider with no tested exit |
| Threshold source | Service levels set by the TPRM lead | Tolerance derived from the board's appetite statement |
| Reported | Monthly to the risk or procurement committee | Quarterly to the board or risk committee |
| Action when red | Management fixes the process | Board decides: accept, fund, diversify or exit |
NIST CSF 2.0 frames both halves: GV.RM-02 asks that risk appetite and risk tolerance statements are established, communicated and maintained, and GV.SC-09 asks that supply chain security practices are integrated into cybersecurity and enterprise risk management programmes and that their performance is monitored. The KRIs below test the first; the KPIs evidence the second. For the wider board reporting approach, see the Board Cyber Risk Reporting Guide.
Write the appetite statements first
KRIs only work when the board has said what it will and will not accept. Draft four to six short third-party appetite statements, get them approved, then derive one or two KRIs per statement. Typical statements:
- Concentration: "No critical business service will depend on a single provider unless an exit or substitution plan has been tested in the last 24 months, or the risk committee has accepted the dependency."
- Residual risk: "We will not run critical services on suppliers whose assessed residual risk is above medium for more than one quarter without a funded remediation plan."
- Onboarding discipline: "No arrangement supporting a critical or important function is signed before its risk assessment, including concentration impact, is complete."
- Supplier incidents: "A material incident at a supplier must not stop a critical service for longer than its impact tolerance."
- Access into core systems: "Suppliers will not hold standing credentials into tier-1 systems unless the credential is scoped, owned, rotated and monitored."
Regulated financial entities in the EU will recognise these: DORA Article 28(2) requires a strategy on ICT third-party risk that is regularly reviewed, Article 28(4) requires all relevant risks of a contractual arrangement to be identified and assessed before it is entered, including whether it may reinforce ICT concentration risk, and Article 28(8) requires exit strategies for ICT services supporting critical or important functions. Where the appetite statement repeats a legal duty, say so on the board page, because the tolerance is then not entirely the board's to set. The Third-Party Risk Regulatory Map lists the duties by jurisdiction.
The ten board KRIs
The population for every KRI is suppliers in the critical tier, as defined by your tiering method (see the Vendor Tiering and Inherent Risk Template). Bands are NHI Mgmt Group starting points; set your own from the appetite statements. KRI-01 and KRI-06 overlap with the health check (TP-09 and TP-05) on purpose, so that the board and the TPRM lead read the same number.
| ID | KRI | Formula | Green | Amber | Red |
|---|---|---|---|---|---|
| KRI-01 | Single-provider critical services | Count of critical business services that depend on one provider, or on several providers sharing one fourth party, with no exit or substitution plan tested in 24 months and no risk committee acceptance | 0 | 1 to 2 | 3 or more |
| KRI-02 | Provider concentration index | Herfindahl-Hirschman index of critical services by provider: sum of the squared share (as a percentage) of critical services each provider supports | Below 1,500 and stable | 1,500 to 2,500, or rising two quarters | Above 2,500 |
| KRI-03 | Critical suppliers above tolerance | Critical suppliers whose residual risk rating is above the appetite level / critical suppliers | 5% or less | Above 5% to 15% | Above 15%, or any for two quarters with no funded plan |
| KRI-04 | Critical arrangements signed before assessment | New arrangements in the quarter supporting critical or important functions signed before the risk and concentration assessment was complete / new such arrangements | 0% | Up to 5%, each with a dated exception | Above 5%, or any without an exception |
| KRI-05 | Shared fourth-party hot spots | Count of fourth parties (cloud region, payment processor, identity provider, managed service) that sit beneath three or more critical suppliers | Known, mapped and flat | Rising | Any new hot spot under a critical service with no fallback |
| KRI-06 | Overdue high-severity supplier findings | Open high-severity findings at critical suppliers past their agreed remediation date / open high-severity findings at critical suppliers | 10% or less | Above 10% to 25% | Above 25% |
| KRI-07 | Material supplier incidents | Count of supplier incidents in the quarter that affected a critical service or your data, with how many met a regulatory notification threshold | 0 notifiable | 1 notifiable, contained within tolerance | Any outside impact tolerance |
| KRI-08 | Exit readiness gap | Recovery or switch time achieved in the latest exit or failover exercise for each critical service, compared with its impact tolerance; report the number of services where the achieved time exceeds tolerance | 0 | 1 | 2 or more, or any untested in 24 months |
| KRI-09 | Standing supplier credentials into tier-1 systems | Count of supplier-held integration tokens, API keys, OAuth grants and service accounts with standing access to tier-1 systems, and the share without a named owner or rotation evidence | Falling; 0% unowned | Flat; up to 5% unowned | Rising, or above 5% unowned |
| KRI-10 | Expired risk acceptances | Supplier risk acceptances for critical suppliers past their expiry date and not renewed by the accepting authority | 0 | 1 to 2, renewal scheduled | 3 or more, or any older than 90 days |
What each KRI tells the board
- KRI-01 and KRI-02: the first is the hard count the board can act on service by service; the second shows whether the overall portfolio is drifting towards fewer providers. The index is a standard concentration measure: a portfolio split evenly across ten providers scores 1,000; one provider holding everything scores 10,000. Use it for trend, not as a regulatory threshold. The Third-Party Concentration Risk Guide explains how to map the dependencies behind both numbers.
- KRI-03: exposure from suppliers you know are weak. Two quarters above tolerance with no funded plan is a governance failure, not a supplier failure.
- KRI-04: whether the business is bypassing the gate. A rising value usually means procurement or a business unit is signing first and asking later.
- KRI-05: concentration you cannot see in your own contract register. Three critical suppliers on the same cloud region is one dependency, not three.
- KRI-06: whether known weaknesses are being fixed at the suppliers that matter. Report the median age in days alongside the ratio.
- KRI-07: realised risk. Pair it with notification clocks: the Third-Party Incident Notification Requirements Guide sets out which incidents start one.
- KRI-08: whether exit plans would work. A plan that has never been exercised is an assumption.
- KRI-09: the identity route from a supplier breach into your estate. The Salesloft Drift breach showed it: integration tokens stolen from one chatbot vendor were used to export data from customers' Salesforce instances in August 2025, with more than 700 organisations potentially affected. The register behind this KRI is described in the Third-Party Credential Register Template.
- KRI-10: whether accepted risks are being revisited. An acceptance that silently expires becomes a permanent exception nobody owns.
Supporting KPIs
Four KPIs explain movement in the KRIs. Report them in the appendix, not on the front page, and keep them distinct from the operational health check measures.
| ID | KPI | Formula | Explains |
|---|---|---|---|
| KPI-01 | Critical due diligence cycle time | Median working days from request to completed risk and concentration assessment for critical arrangements | KRI-04: long cycle times push the business to sign first |
| KPI-02 | Supplier breach to revocation time | Hours from a critical supplier's breach notice to confirmation that every credential it held into your systems was rotated or revoked | KRI-07 and KRI-09 |
| KPI-03 | Exit plan exercise coverage | Critical services whose exit or failover plan was exercised in the last 24 months / critical services | KRI-01 and KRI-08 |
| KPI-04 | Appetite review currency | Third-party appetite statements and tolerances reviewed by the board in the last 12 months / statements in force | All KRIs: stale tolerances make green meaningless |
Building the board page
The board page is one page. Everything else is appendix.
- Header line: overall third-party exposure in one sentence, with the direction since last quarter.
- KRI table: ID, name, current value, band, four-quarter trend arrow and the appetite statement it tests.
- Top three concentrations: the named critical services behind KRI-01 and KRI-05, each with the provider, the fallback status and the date of the last exercise.
- Material events: supplier incidents in the period (KRI-07), notifications made and impact against tolerance.
- Decisions requested: each red KRI with a recommendation: accept with a dated expiry, fund diversification or remediation, restrict the service, or exit the supplier.
- Appendix: KPIs, method notes, data quality caveats and the population definitions.
The Board Cyber Report Template gives a layout this page can slot into. Name suppliers on the board page only where the board must make a decision about them; elsewhere, report by service.
Rolling out the KRI set
- Quarter 1, baseline: agree the critical tier, the list of critical business services and the appetite statements. Calculate KRI-01, KRI-03, KRI-06 and KRI-07 from the data you already have, and present them as a baseline with no bands.
- Quarter 2, bands: propose bands from the appetite statements, test them against the baseline (a set where everything is red, or everything green, is miscalibrated) and get board approval.
- Quarter 3, concentration: add KRI-02, KRI-05 and KRI-08 once the service dependency map and fourth-party disclosures are good enough to trust. Mark them as "indicative" until the data quality check passes.
- Quarter 4, credentials and gating: add KRI-04, KRI-09 and KRI-10. KRI-09 needs IAM and secrets data joined to the supplier register, which usually takes a quarter of work.
- Every quarter after: internal audit re-performs two KRIs on a sample; retire any KRI that has been green and flat for four quarters and replace it with one that tests a new risk.
Rollback: if a new KRI produces numbers nobody trusts, move it back to the appendix as indicative rather than dropping it silently, and record why in the method notes.
Choosing KRIs by size and maturity
| Organisation | Start with | Add later | Why |
|---|---|---|---|
| Small (under about 50 material suppliers) | KRI-01, KRI-03, KRI-07, KRI-09 | KRI-08 | A handful of SaaS and managed service providers usually hold most of the exposure; the index adds little |
| Mid-size | KRI-01, KRI-03, KRI-04, KRI-06, KRI-07, KRI-09 | KRI-02, KRI-05, KRI-10 | Gating and finding closure are where growing programmes slip |
| Large or regulated (DORA, PRA SS2/21, US interagency guidance) | All ten | Sector-specific KRIs, such as register of information quality | Regulators expect concentration, exit and board reporting to be evidenced |
Maturity matters as much as size. At the Ad hoc and Developing levels of the Third-Party Risk Management Maturity Model, the supplier inventory is not complete enough for concentration KRIs to mean anything: fix inventory first and report KRI-01 by named service. At the Managed level, all ten should be calculated from systems rather than spreadsheets.
Data sources and measurement quality
| KRI | Primary data | Typical quality problem | Check |
|---|---|---|---|
| KRI-01, KRI-02, KRI-08 | Business service map, business continuity exercise records | Service map built from contracts, not from how the service actually runs | Walk one critical service end to end with its owner each quarter |
| KRI-03, KRI-06, KRI-10 | TPRM register, finding and exception logs | Ratings never refreshed after the initial assessment | Report the age of each rating alongside it |
| KRI-04 | Contract signature dates joined to assessment completion dates | Assessment dated after signature but backdated in the tool | Use system audit timestamps, not entered dates |
| KRI-05 | Supplier subcontractor disclosures, DORA register of information | Disclosures incomplete or out of date | Cross-check against hosting and status-page information for critical suppliers |
| KRI-07 | Incident register, supplier notifications | Supplier incidents logged as "vendor issue" outside the incident process | Reconcile supplier notifications received against incident tickets |
| KRI-09 | IAM, secrets manager, SaaS connected-app inventories | Tokens created by integrations never linked to a supplier | Sample ten tier-1 integrations and trace each credential to a supplier record |
For EU financial entities, DORA Article 28(3) requires a register of information covering all contractual arrangements on the use of ICT services, kept at entity, sub-consolidated and consolidated level, so the register is the natural source for KRI-02 and KRI-05. The DORA Register of Information Guide covers how to build it. Continuous signals from monitoring feeds can support KRI-03 between assessments; see the Continuous Vendor Monitoring Guide.
Common failure patterns
- Reporting the questionnaire count. "412 assessments completed" is effort. Boards cannot set appetite on effort, and the number grows even as exposure grows.
- Averaging security ratings. A portfolio average of external ratings hides the one critical provider that matters. Report the critical tier separately, and treat ratings as one input to KRI-03, not the KRI itself.
- Counting contracts, not services. Ten contracts with one hyperscaler can look like diversification on a contract list. Concentration has to be counted by critical service and by shared fourth party (KRI-01, KRI-05).
- Ignoring credentials. Supplier assessments that score policies but never ask what tokens the supplier holds miss the route by which supplier breaches become customer breaches, as the Salesloft Drift breach showed.
- Bands set to make the page green. If every KRI has been green for a year, either the risk is truly gone (retire the KRI) or the band is wrong. Ask internal audit to test the calibration.
- Risk acceptance as a permanent state. Acceptances without an expiry and a named accepting authority remove the risk from the page without removing it from the business (KRI-10).
Framework mapping
| KRI or practice | NIST CSF 2.0 | NIST SP 800-53 Rev 5 | Regulatory reference |
|---|---|---|---|
| Appetite statements and tolerances | GV.RM-02 | PM-30 Supply Chain Risk Management Strategy | US interagency guidance D.1 (board sets risk appetite) |
| KRI-01, KRI-02, KRI-05 concentration | GV.SC-04, GV.SC-07 | SR-2 Supply Chain Risk Management Plan | DORA Art. 28(4)(c) and Art. 29(1) |
| KRI-03, KRI-06 residual risk and findings | GV.SC-07 | SR-6 Supplier Assessments and Reviews | US interagency guidance D.3 (reporting to the board) |
| KRI-04 assessment before signing | GV.SC-07 | SR-3 Supply Chain Controls and Processes, SA-9 External System Services | DORA Art. 28(4) |
| KRI-08 exit readiness | GV.SC-10 | SR-2 | DORA Art. 28(8) |
| KRI-09 supplier credentials | GV.SC-07 | SA-9, IA-5 Authenticator Management | |
| Board reporting cycle | GV.SC-09, GV.SC-03 | CA-7 Continuous Monitoring | DORA Art. 5(2)(h) and (i) |
ISO/IEC 27001:2022 Annex A controls 5.19 to 5.22 (information security in supplier relationships, within supplier agreements, in the ICT supply chain, and monitoring, review and change management of supplier services) cover the same ground from the management system side, and CIS Controls v8.1 Control 15 (Service Provider Management) covers the operational practices the KPIs measure.
Practitioner checklist
- Get four to six third-party appetite statements approved before proposing any KRI.
- Define the critical tier and the list of critical business services, and freeze the definitions for the reporting year.
- Map each KRI to one appetite statement and record the mapping on the board page.
- Count concentration by critical service and by shared fourth party, not by contract.
- Join IAM, secrets and SaaS connected-app data to the supplier register so KRI-09 can be calculated.
- Show four quarters of trend for every KRI and the decision requested for every red one.
- Give every risk acceptance an expiry date and a named accepting authority.
- Have internal audit re-perform at least two KRIs a year and test the band calibration.
- Keep the operational measures in the TPRM Programme Health Check and share no more than two with the board set.
Standards and references
- EUR-Lex: Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA)
- Federal Register: Interagency Guidance on Third-Party Relationships: Risk Management
- Bank of England PRA: SS2/21 Outsourcing and third party risk management
- NIST: SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
- NIST: Cybersecurity Framework 2.0
- NCSC: Principles of supply chain security
- OCC: Bulletin 2023-17, Interagency Guidance on Third-Party Relationships: Risk Management
Related NHI Mgmt Group resources: Third-Party Risk Management Guide, Third-Party Risk Management Maturity Model, TPRM Programme Health Check, Third-Party Concentration Risk Guide, Key Risk Indicators for Cyber Risk Guide.