A third-party risk management (TPRM) platform can report a healthy programme while its own configuration has drifted: tiering rules edited without approval, escalation timers switched off, vendor portal accounts left active after a supplier leaves, and integrations that stopped syncing months ago. This health check audits the platform itself, not the programme it supports. It measures who administers the tool, whether workflows still behave as designed, whether data from procurement, contract and monitoring sources is arriving, and whether the credentials and logs behind it are under control. It is for TPRM platform owners and administrators, the identity and security operations teams who support them, and the auditors who rely on platform output as evidence.
Programme outcomes such as tiering coverage, overdue assessments, finding age and contract clause coverage belong in the TPRM Programme Health Check; this page measures whether the platform producing those figures can be trusted. Platform selection criteria are in the TPRM and Security Ratings Buyer's Guide, and the people side of supplier access is measured in the Third-Party Access Health Check.
What this health check covers
The eight metrics cover four areas:
- Platform access: internal administrator and privileged role hygiene, and the lifecycle of external vendor portal accounts.
- Workflow integrity: unapproved changes to tiering rules, questionnaire templates and SLA timers, and workflow instances that have stalled with no owner.
- Integrations: sync health with procurement, contract management and identity systems, and the hygiene of the API keys and OAuth clients those integrations use.
- Data and evidence: freshness of continuous monitoring and fourth-party feeds, and the integrity of audit logs and register exports.
Who runs it: the TPRM platform owner collects the data, the identity team reviews access figures, security operations reviews logging, and the head of third-party risk signs it off. How to audit a TPRM tool with it: run all eight metrics each quarter, raise a finding for every amber or red result, and run it before you report programme KPIs so that known platform faults are disclosed alongside them.
The metrics evidence NIST SP 800-53 Rev. 5 AC-2 (account management), AC-6 (least privilege), IA-2 (identification and authentication, organisational users), CM-3 (configuration change control), CM-6 (configuration settings) and AU-6 (audit record review, analysis and reporting), applied to the system that supports SA-9 (external system services) and SR-6 (supplier assessments and reviews). In NIST CSF 2.0 they support GV.SC-09, which asks that supply chain security practices are integrated into cybersecurity and enterprise risk management and that their performance is monitored, together with PR.AA-05 (access permissions are managed and reviewed) and PR.PS-01 (configuration management practices are applied). NIST SP 800-161 Rev. 1, the cybersecurity supply chain risk management guide, frames the wider programme; see the NIST SP 800-161 Cyber Supply Chain Risk Management Guide.
Key takeaways
- Programme KPIs are only as good as the platform. A tiering rule edited without approval or a broken escalation timer silently changes every downstream figure.
- The platform holds sensitive supplier evidence. SOC reports, penetration test summaries and incident details make admin roles and vendor portal accounts worth protecting with SSO and phishing-resistant MFA.
- Vendor portal accounts outlive vendors. External contacts change jobs and contracts end; portal accounts need the same leaver process as any other external identity.
- Integrations are non-human identities. Every procurement, contract, ticketing and ratings connector holds a credential that needs an owner, a scope and a rotation date.
- Stale feeds look like good news. A monitoring feed that stopped updating produces no alerts, which reads as low risk until someone checks the last sync time.
How to use this template
Copy the metrics table and the findings log into your own tracker, then run this TPRM Platform Health Check at the cadence below. Collect each figure from the data sources described, score it against the thresholds, and record every amber or red result as a finding with an owner and a due date. Keep each completed review: a configuration change count that rises every quarter, or a sync error rate that never quite reaches red, is a signal in its own right.
Cadence and sign-off
| Review | Frequency | Owner | Approver | Evidence kept |
|---|---|---|---|---|
| Integration sync and feed failures | Daily (automated alert), reviewed weekly | TPRM platform administrator | TPRM platform owner | Sync job history, failure tickets |
| Configuration change reconciliation | Monthly | TPRM platform owner | Head of third-party risk | Platform audit log extract matched to change records |
| Full health check (all eight metrics) | Quarterly, before programme KPI reporting | TPRM platform owner | Head of third-party risk or CISO | Metrics table, findings log, exports |
| Admin, user and vendor portal account review | Quarterly | Identity team | TPRM platform owner | Role export, portal account list, MFA status |
| Integration credential review | Quarterly and on any integration change | TPRM platform administrator | Identity team | Credential list with owner, scope, created and rotated dates |
| Independent assurance | Annually | Internal audit | Audit committee | Audit report, management responses |
Metrics
NHI Mgmt Group recommended thresholds; adjust to your risk appetite. "Controlled configuration" means tiering and inherent risk scoring rules, questionnaire templates and their scoring, workflow stages, SLA timers, escalation rules, notification routing and role definitions.
| ID | Metric | Formula | Data source type | Green | Amber | Red |
|---|---|---|---|---|---|---|
| TPP-01 | Admin and privileged role hygiene | Accounts with platform admin, configuration or bulk export rights that are named, signed in through SSO with phishing-resistant MFA, within the approved maximum count and reviewed this quarter / accounts with those rights | Platform role export, identity provider assignment and sign-in logs | 100% and count at or below maximum | 95% to below 100%, or count up to 20% above maximum | < 95%, any local password-only admin, or any shared admin account |
| TPP-02 | Vendor portal account lifecycle | Active external portal accounts belonging to vendors that are offboarded, contacts the vendor has confirmed as leavers, or accounts with no sign-in for 180 days / active external portal accounts | Portal user export, vendor status field, sign-in history | 0% | Above 0% to 3% | > 3%, or any account for an offboarded vendor older than 30 days |
| TPP-03 | Configuration drift | Changes to controlled configuration in the quarter with no matching approved change record / changes to controlled configuration in the quarter | Platform audit log, configuration export compared with last quarter's baseline, change records | 0% | Any unrecorded change approved retrospectively within 10 days | Any unrecorded change to tiering, scoring or SLA rules |
| TPP-04 | Stalled workflow instances | Open assessment, finding and onboarding workflow instances with no active assignee, a disabled or failed escalation, or no status change for 60 days / open workflow instances | Platform workflow report, escalation job log | ≤ 2% | Above 2% to 5% | > 5%, or any stalled instance for a vendor in the top tier |
| TPP-05 | Integration sync health | Scheduled sync runs with procurement or ERP, contract management, identity provider and ticketing systems that completed without error / scheduled sync runs in the quarter; plus the count of vendor or contract records failing sync for over 7 days | Integration job history, error queue, record reconciliation against source systems | ≥ 99% and no records failing over 7 days | 95% to below 99%, or records failing over 7 days on lower tiers only | < 95%, or any top tier vendor or contract record failing over 7 days |
| TPP-06 | Integration credential hygiene | API keys, OAuth clients and service accounts used by or against the platform with a named owner, least privilege scope, a known last-use date and rotation within policy / such credentials | Platform API key and connected app list, identity provider app registrations, secrets manager records | 100% | 90% to below 100% | < 90%, or any unowned credential with admin or export scope |
| TPP-07 | Monitoring and fourth-party feed freshness | Configured external data feeds (security ratings, threat and breach notifications, sanctions or financial data, fourth-party and subcontractor data) that delivered data within their expected interval, with alerts routed to a named queue / configured feeds | Feed connector status, last successful update time, alert routing rules | 100% | 90% to below 100% | < 90%, or any feed silent for more than 3 times its interval |
| TPP-08 | Audit log and evidence integrity | Three checks scored together: platform audit log streamed to the SIEM with no gap over 24 hours; evidence and document retention settings matching the approved schedule; regulatory register exports passing validation with zero unresolved errors | SIEM ingestion report, platform retention settings, register export validation report | All three pass | One fails with a fix scheduled | Two or more fail, or audit logging disabled at any point |
Alongside the table, report two counts without thresholds: bulk exports of supplier evidence or vendor lists in the quarter, each matched to a requester and purpose, and new connected apps or integrations added. Both should be small, explained and expected.
How to collect the data
- Export roles and match them to the identity provider (TPP-01). List every account with admin, configuration, bulk export or API management rights. Match each to the identity provider: named user, assigned through a group, signing in through SSO, and using phishing-resistant MFA. CISA describes FIDO/WebAuthn and PKI-based authentication as the phishing-resistant forms, and treats app codes, push and SMS as interim options. Flag any local accounts that bypass SSO, including break-glass accounts without monitoring.
- Join portal accounts to vendor status (TPP-02). Export external portal users with their vendor, last sign-in and created date, then join on the vendor record's lifecycle status. Accounts linked to offboarded vendors are the first priority. Ask top tier vendors to confirm their contact list each quarter. Where internal users are provisioned by SCIM, confirm that deprovisioning works end to end: RFC 7644 defines removal through an HTTP DELETE on the user resource, after which the provider must stop returning that user.
- Diff configuration against a baseline (TPP-03). Export controlled configuration at the end of each quarter and compare it with the previous export. Pull the platform audit log for configuration events and match each change to an approved change record. Changes to inherent risk scoring or tiering logic matter most, because they move vendors between tiers without anyone reassessing them.
- Find stalled instances (TPP-04). Report open workflow instances with no assignee, assignees who have left or changed role, escalation jobs that failed, and instances with no status change for 60 days. The cause is usually a deleted user, a renamed group or a disabled notification rule, not a slow vendor.
- Reconcile integrations with source systems (TPP-05). Read the job history for each scheduled sync and the error queue. Then compare counts: active suppliers in procurement or ERP against active vendor records, signed contracts in contract management against linked contract records. A gap here undermines inventory and contract coverage figures in the programme health check.
- List integration credentials (TPP-06). Export platform API keys and connected apps, and the identity provider app registrations and service accounts the platform uses to reach other systems. Record owner, scope, created date, last use and last rotation. See the SaaS and OAuth App Governance Guide for scope review.
- Check last update time per feed (TPP-07). For each external data feed, record the expected interval, the last successful update and where its alerts go. Confirm alerts land in a monitored queue with an owner, not a shared mailbox nobody reads. See the Continuous Vendor Monitoring Guide for what feeds should cover.
- Prove logs and exports (TPP-08). Use the SIEM ingestion report for the platform's audit log, compare retention settings with the approved schedule, and run the register export through its validation step. EU financial entities using the platform for their DORA register of information should note that Commission Implementing Regulation (EU) 2024/2956 requires the register to meet accuracy, completeness, consistency, integrity, uniformity and validity principles, with errors corrected promptly; see the DORA ICT Third-Party Risk and Register of Information Guide.
Store the evidence outside the platform, so a compromised admin account cannot alter the record of its own activity.
Red flags that need action now
- A tiering or inherent risk scoring rule changed with no change record, or vendors moved to a lower tier in bulk.
- Platform admins signing in with a local password, or a shared admin account in use.
- Active vendor portal accounts for suppliers that were offboarded months ago.
- Bulk export of supplier evidence or the full vendor list with no request on record.
- An integration credential with admin or export scope and no owner, or one that has never been rotated.
- A security ratings or breach notification feed that has been silent for weeks with no alert.
- Platform audit logging disabled, or a gap in SIEM ingestion that nobody investigated.
Treat unexplained configuration changes and bulk exports as possible misuse, not housekeeping. The platform holds a map of your suppliers, their weaknesses and their access, which is useful to an attacker planning a supply chain route in.
Findings log
| ID | Finding | Metric | Severity | Owner | Due date | Status |
|---|---|---|---|---|---|---|
| HC-TPP-01 | [e.g. 3 platform admins sign in with local passwords outside SSO] | TPP-01 | [Critical] | [Identity team] | [date] | [Open] |
| HC-TPP-02 | [e.g. 41 portal accounts belong to offboarded vendors] | TPP-02 | [High] | [TPRM platform administrator] | [date] | [Open] |
| HC-TPP-03 | [e.g. inherent risk scoring weights changed without approval] | TPP-03 | [High] | [TPRM platform owner] | [date] | [Open] |
| HC-TPP-04 | [e.g. contract management sync failing for 19 days] | TPP-05 | [Medium] | [Integration owner] | [date] | [Open] |
Severity guide: Critical where someone could alter or extract supplier risk data without detection, High where programme figures are materially wrong or external access is left open, Medium for integration and feed gaps on lower tiers, Low for record-keeping gaps.
Remediation map
| Finding type | Where the fix is described |
|---|---|
| Admin roles, SSO and MFA gaps | Identity Provider and SSO Security Guide |
| Vendor portal accounts and supplier contacts not removed | Vendor Offboarding and Termination Guide and Third-Party Access Health Check |
| Internal users not deprovisioned | SCIM Provisioning Guide |
| Integration credentials without owner, scope or rotation | SaaS and OAuth App Governance Guide |
| Monitoring and fourth-party feeds silent or unrouted | Continuous Vendor Monitoring Guide and Fourth-Party and Nth-Party Risk Guide |
| Platform capabilities missing for these checks | TPRM Platform RFP Template |
| Audit log not reaching the SIEM | SIEM health check |
Related guides
- TPRM Programme Health Check: the programme outcome metrics this platform produces.
- Third-Party Risk Management Guide: the programme design the platform supports.
- TPRM and Security Ratings Buyer's Guide: what to require from the platform and its data feeds.
- Third-Party Access Health Check: supplier access to your own systems.
- Third-Party Risk KPIs and KRIs to Report to the Board: reporting once the platform data is trustworthy.
References
- NIST: SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
- EUR-Lex: Commission Implementing Regulation (EU) 2024/2956 on the register of information templates
- CISA: Implementing Phishing-Resistant MFA
- IETF: RFC 7644, System for Cross-domain Identity Management: Protocol
- NCSC: Supply chain security guidance, principles
Related NHI Mgmt Group resources: TPRM Programme Health Check, TPRM and Security Ratings Buyer's Guide, Third-Party Access Health Check and Vendor Offboarding and Termination Guide.