Skip to main content
All glossary terms

Regulation & risk

Third-Party Risk Management (TPRM)

Third-party risk management (TPRM) is the process of understanding and addressing risks introduced by suppliers, service providers, and other external parties. It can include due diligence, contract review, access decisions, monitoring, and plans for changing or ending a relationship.

Also known as TPRM, vendor risk management.

Why it matters in practice

External services can handle data or support critical operations, so assessment should reflect the relationship’s actual access and importance. A questionnaire alone may not capture technical dependencies or ongoing changes. TPRM connects procurement and security work with owners who can make decisions about residual risk.

Example

Before connecting a provider to a test environment, an organization reviews its data access, support model, and exit plan with the service owner.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.