Third-Party Risk Management (TPRM)

What is third-party risk management?

Third-party risk management (TPRM) is how you manage the risks that come from any outside company you work with. That includes software vendors, but also contractors, agencies, resellers, payment partners and anyone else who touches your data, systems or customers.

The US bank regulators' 2023 guidance shows how wide the term is. It covers "any business arrangement between a banking organization and another entity, by contract or otherwise." A relationship does not need a signed contract to count.

TPRM and vendor risk management (VRM) use the same methods. The difference is scope. VRM looks at the companies you buy from. TPRM also includes partners you sell through, integrate with or share customers with. For most 20 to 100 person SaaS companies, almost every third party is a vendor, so the two programs end up being the same list.

TPRM frameworks were written for banks, so they can look heavy. The interagency guidance lists five stages: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination. Here is what is realistic at 50 people.

1. Planning: a short note on why you need the tool and what data it will get.
2. Due diligence: a check of the vendor's SOC 2 report, DPA and subprocessor list, scaled to its tier.
3. Contract: reading the change, data, liability and renewal clauses before you accept.
4. Ongoing monitoring: a way to learn about changed terms, new subprocessors and expired reports.
5. Termination: export, deletion and access removal when you leave.

What you can skip: on-site audits, custom 300-question questionnaires for every tool, and a dedicated TPRM platform before you have more vendors than a spreadsheet can hold.

What it looks like in a vendor's terms

TPRM depends on what the third party promises in writing. Security promises often sit in an exhibit or security addendum. A typical clause reads like this:

Provider will maintain the security measures described in the Security Exhibit. Provider may update the Security Exhibit from time to time, provided that updates do not materially reduce the overall protection of Customer Data.

• "Security Exhibit" is a separate document that lists the actual controls, such as encryption, access control and staff screening.
• "May update" means the list can change after you sign.
• "Do not materially reduce the overall protection" leaves it to the vendor to judge whether removing one control is a real reduction.

A real change we caught

Venpo flagged that Splunk took background checks out of two security exhibits, the ones for its on-premises products and Observability Cloud, in September 2026. If your review counted on staff background checks for those products, your file would still show a control that the exhibits no longer list. A one-time assessment has no way to catch that.

Why it matters to you

The bank guidance tells banks to tailor oversight "commensurate with the banking organization's size, complexity, and risk profile." The same logic applies to you. You do not need a bank's program, but your customers will still ask about your third parties.

Enterprise buyers send security questionnaires that ask how you vet vendors. A SOC 2 auditor will test the CC9.2 criterion, which says "The entity assesses and manages risks associated with vendors and business partners." Note "business partners": a reseller or integration partner with access to customer data counts too.

And when a third party has an incident, your customers will ask you, not them. Their contract is with you.

Third parties also bring their own third parties. Your vendor's cloud host, AI provider and support tool are your fourth parties. You cannot assess them all, but you can read your vendor's subprocessor list and know when it changes.

What to check

• Your list includes non-software third parties too: contractors, agencies and partners with system access or customer data.
• Each third party has a tier based on data sensitivity and access to your systems, as NIST's quick-start guide suggests.
• For top-tier vendors, you have the current SOC 2 report, the DPA and the security exhibit version you agreed to.
• You know whether the security exhibit can change and how you will be told.
• You have a plan for "activities that occur after the conclusion" of the relationship (NIST CSF GV.SC-10): data return, deletion and removing access.

How Venpo helps

Venpo handles the document side of third-party monitoring. It watches each vendor's Terms of Service, privacy policy, DPA, subprocessor list and other public legal pages, and sends a plain-English email alert when one changes, so a removed control or a new subprocessor shows up the week it happens rather than at your next review.