Third-Party Risk Management (TPRM)
Third-Party Risk Management (TPRM) is the discipline of identifying, assessing, monitoring, and managing risk introduced by vendors, service providers, contractors, and other external parties across the vendor lifecycle.
What TPRM Actually Covers
TPRM spans the full vendor lifecycle: pre-engagement due diligence, contract negotiation with appropriate security and privacy terms, ongoing monitoring of vendor security posture, incident response coordination when vendors have incidents, and offboarding when relationships end. Each stage has its own controls, artifacts, and stakeholders.
The scope has expanded substantially. Traditional TPRM covered specific vendor categories. Modern TPRM covers essentially every external party with any meaningful data access or operational integration, which for many enterprises means hundreds or thousands of relationships.
Why TPRM Has Grown in Importance
Vendor-driven incidents have become one of the primary sources of enterprise cyber loss. Supply chain attacks, vendor data breaches, and vendor operational failures all produce material impact on the customer organizations. Regulatory frameworks including DORA, NIS2, and the SEC Cyber Disclosure Rule all elevate third-party risk explicitly.
See what keeps a CISO up at night: managing cyber supply chain risk.
TPRM and Quantification
Modern TPRM increasingly uses quantified analysis to prioritize among a large vendor portfolio. Not every vendor deserves equal scrutiny. Quantified analysis identifies which vendors carry the most exposure and where deeper assessment or monitoring is worth the operational cost.
AI Vendors as a New TPRM Category
AI vendors introduce specific risks that traditional TPRM was not designed to assess. See AI third-party risk management for the AI-specific dimension.
Related Terms
Turn Cyber Risk Into Financial Exposure the Board Can Act On
Security leaders are being asked to defend budgets, prioritize controls, and report cyber risk in the same terms as every other enterprise risk. Kovrr's CRQ Platform models loss scenarios, benchmarks control performance, and gives the C-suite a defensible view of where cyber sits on the balance sheet.
