Third-Party, Supply Chain, and Vendor Risk
Third-Party, Supply Chain, and Vendor Risk
This domain tests whether you can tier suppliers by risk, apply proportionate due diligence, and prove ongoing oversight rather than a one-time questionnaire. Expect questions on contract clauses, fourth parties, concentration risk, and software supply chain assurance.
Tiering and diligence
Tier vendors by data sensitivity, system criticality, and access level. Tier 1 (regulated data or availability-critical) requires deeper diligence: security questionnaire plus independent assurance (SOC 2 Type II, ISO 27001 certificate with scope), penetration test summaries, and a named security contact. Tier 3 may only need a standard questionnaire and contractual terms.
Contract clauses that carry weight
Right to audit or agreed audit report access, breach notification timelines (often 24-72 hours), data return and certified destruction on exit, subcontractor flow-down obligations, SLA and security commitments with remedies, and cooperation with regulators.
Ongoing monitoring
Continuous monitoring, security ratings, annual reassessment, and trigger-based review after the vendor's own incident or a material change in service. Map fourth parties - the vendor's subcontractors - since your data often reaches them. Concentration risk matters: three critical services on one cloud region is a single point of failure. For software supply chain, request an SBOM, verify signed artifacts, and track critical vulnerabilities in dependencies.
Worked example
A tier-1 payroll provider discloses a breach. The contract requires notification within 24 hours and grants audit rights. Actions: invoke the notification clause, request scope, affected data categories, and forensic timeline; assess which of your data fields were exposed; determine whether regulatory clocks start; engage legal on contractual remedies; and confirm whether the provider's subcontractors were involved. Reasoning: the contract converts a surprise into a process - without notification and audit rights, you learn from the press.
Traps that cost marks
- Treating a SOC 2 Type II report as blanket assurance; check scope, period, and exceptions.
- Assessing once at onboarding and never again.
- Missing subcontractor flow-down, so fourth-party exposure is invisible.
- Contracting without exit, data return, or destruction terms.
- Applying tier-1 diligence to every vendor, which is unaffordable and dilutes focus.