What Is a Third-Party Risk Assessment? Definition, Process, and Examples

Your vendor list grows faster than your team can review it, and last year's questionnaire answers go stale fast. A third-party risk assessment lets you find which outside companies could expose your data or disrupt your operations, so you know where to focus.

Your vendors feel the same strain, since many of them field near-identical questionnaires from every customer. That volume slows their responses and invites copy-and-paste answers that say little about current controls.

Third-party risk assessment, defined 

A third-party risk assessment examines each outside relationship before you sign and throughout the contract. It weighs the third party's security controls, the data and systems it can reach, and how much your business depends on it. 

Vendors and suppliers get most of the attention, but the review applies to any partner that handles your sensitive data or touches your systems.

What you learn decides how much scrutiny, contract protection, and monitoring each relationship gets. 

A point-in-time assessment is only as current as the evidence behind it. A vendor that passed review in March can change by June, so findings should feed ongoing oversight instead of ending as a filed report.

Why third-party risk assessments matter

Your attack surface extends into every vendor that stores your data or connects to your systems. When one of those vendors suffers a breach or a supply chain attack, the fallout often reaches your customers and your own compliance obligations.

Third-party risk management (TPRM) programs exist to manage that exposure, but they depend on inputs you can trust. 

Confidence is scarce, and the 2026 KPMG Global TPRM Survey of 851 organizations found only 15% of leaders have high confidence in their data. KPMG recommends focusing on the small group of third parties that pose material threats, and a tiered assessment program puts that advice into practice.

Regulators also expect documented, risk-based oversight of outside providers. These frameworks set the most common expectations:

• Digital Operational Resilience Act: Article 28 of Regulation (EU) 2022/2554 requires EU financial entities to manage risk from their technology providers and keep a register of information on those contracts.
• NIS2 Directive: Article 21 of Directive (EU) 2022/2555 requires essential and important EU entities to address supply chain security, including security aspects of their relationships with direct suppliers.
• New York State Department of Financial Services Part 500: Section 500.11 requires policies for identifying and periodically assessing third-party service providers.
• Interagency guidance on third-party relationships (2023): US banking regulators set risk-based expectations across the life of each relationship.

A documented assessment gives you defensible evidence for audits and board reporting on TPRM performance. It shows what you reviewed and why you accepted the remaining risk.

Third-party risk assessment vs vendor risk assessment

A third-party risk assessment covers every outside relationship, including contractors and affiliates, plus the open-source code your software depends on. A vendor risk assessment is the narrower subset focused on companies you buy products or services from. 

Both happen in the assessment stage of the TPRM lifecycle, and you can often use the same questionnaires and scoring models.

The table below compares the two side by side:

What a third-party risk assessment includes

A complete assessment tells you how much risk a relationship carries and whether the third party's controls bring it to an acceptable level. Most third-party risk assessments include these components:

• Scope and inherent risk profile: What the third party does for you, and the data and systems it can reach.
• Security controls evidence: Answers to a vendor questionnaire and independent proof such as SOC 2 Type II reports and ISO 27001 certificates.
• External security posture: Outside-in scanning and security ratings that test questionnaire claims against what's visible from the internet.
• Compliance and contractual obligations: Data processing terms and breach notification clauses that make the vendor's commitments enforceable.
• Risk findings and remediation plan: Rate each gap by severity, with an owner and a deadline for the fix.
• Residual risk decision: Your formal call on the risk that remains after controls, and the date of the next review.

Inherent risk is the exposure a relationship carries before controls, while residual risk is what's left after them. Outside-in evidence keeps questionnaire answers honest, since a vendor claiming strong patching shouldn't show outdated, exposed services from the outside.

Examples of third-party risk

Third-party risk appears in several forms, and a thorough assessment checks for each one. The incidents below come from public investigations and show what each risk type looks like.

Cybersecurity risk

Attackers often reach your data through a vendor relationship, using stolen credentials or compromised software updates. Mandiant's investigation of the 2024 Snowflake customer data thefts traced every incident it handled to compromised customer credentials. Mandiant found no evidence of a breach of Snowflake's own environment.

The weak point sat between each customer and the platform, so your assessment should cover shared responsibility. Ask how the vendor enforces multi-factor authentication and which credential controls your own team owns.

Operational risk

A critical provider can halt your operations with no attacker involved. CrowdStrike's root cause analysis traces the July 2024 outage to a faulty content update. A mismatch in the number of input parameters the sensor expected caused the failure.

Outages like that one fall under business continuity and concentration risk. Ask critical vendors how they stage and roll back updates, and check whether your recovery plans account for their failure.

Compliance and regulatory risk

A vendor's mishandling of regulated data can become your violation, because many laws hold you accountable for the providers you choose. Under Article 28 of the GDPR, you must use only processors that offer sufficient guarantees and govern their processing by contract.

In US healthcare, vendors that handle protected health information fall under HIPAA. After the 2024 Change Healthcare cyberattack, the Office for Civil Rights at the Department of Health and Human Services opened investigations into Change Healthcare and its parent, UnitedHealth Group. It also reminded covered entities of their HIPAA obligations to have business associate agreements in place.

Financial and reputational risk

A vendor in financial trouble may cut security spending or shut down with your data still on its servers. Assessments of critical vendors often include financial health checks, such as credit reports or audited statements, along with an exit plan.

Reputational damage follows a different path, because customers rarely separate your brand from a partner's failure. If a vendor leaks your customer data, the notification letters usually carry your name.

Fourth-party risk

Your vendors depend on their own providers, and those dependencies become your exposure. The European Union Agency for Cybersecurity documents a September 2025 ransomware incident at Collins Aerospace in its Threat Landscape 2026 report. 

The attack hit the company's passenger-processing software and disrupted automated check-in at several EU airports, including Brussels and Berlin.

For the airlines operating at those airports, Collins Aerospace was a fourth party: their vendor’s vendor. Ask critical vendors to name their key subcontractors so you can spot concentration on shared providers such as cloud hosting.

Asking only works for the subcontractors a vendor chooses to name. UpGuard Vendor Risk maps fourth-party connections automatically, so shared dependencies and concentration risk across your vendor portfolio show up in one view.

The table below summarizes each risk type and the evidence an assessment typically gathers for it:

The third-party risk assessment process

In the UpGuard TPRM lifecycle, assessments follow discovery and onboarding, then feed into ongoing risk management and continuous monitoring. 

A common scoring method comes from NIST SP 800-30, which rates risk by likelihood and impact.

1. Inventory your third parties: List every outside company with access to your data or systems, including shadow vendors that procurement never processed. Expense reports and single sign-on logs often reveal them.
2. Tier by inherent risk: Use vendor tiering to rank each third party by the data and systems it can reach and how much you depend on it. That tier sets the depth of every later step.
3. Collect evidence: Send questionnaires that match the vendor’s tier and request supporting documents such as audit reports. Pull outside-in scan results at the same time.
4. Analyze and score: Rate each finding by likelihood and impact, following NIST 800-30, then check questionnaire claims against the security posture you can observe externally.
5. Remediate and decide: Assign each finding an owner and a deadline, then track fixes to closure. Record the residual risk decision and who approved it.
6. Monitor and reassess: Continuous monitoring re-scores vendors as their external posture changes, giving you a current view between reviews. Reassess on a cadence your tiering sets, or sooner after a significant change.

Evidence collection usually takes the most analyst time, so an accurate tier in step two saves effort in every step after it.

Some of that collection can happen before you ask. UpGuard maintains thousands of pre-sourced evidence documents for most monitored vendors, and pre-fills 49% of NIST CSF 2.0 checks and 46% of ISO 27001:2022 checks for the 100 most monitored vendors. Uploading a single SOC 2 report can complete 61% of NIST CSF or ISO 27001 risk assessments, cutting the follow-up questionnaire from 241 questions to 94.

How to keep third-party risk assessments manageable

Assessment volume tends to grow faster than headcount, making understaffing a major issue. Fixing it starts with knowing where the strain comes from, then changing how you assign depth and evidence.

Why assessments feel overwhelming

Practitioners on both sides of the questionnaire describe the same frustration. In one Reddit cybersecurity thread, a practitioner described a four-person team at a midsize company responding to risk assessments from around 100 corporate clients. Security teams on the sending side feel it too, because every slow response delays their review.

Duplicate questionnaires drive much of the load, and the EY 2025 Global TPRM Survey found 43% of large companies use multiple questionnaires across risk domains. 

Organizations in the survey, all with $250 million or more in revenue, send third parties an average of 55 questionnaires.

Add one-size-fits-all depth and manual follow-up, and both sides spend hours on relationships that carry little risk.

Match assessment depth to vendor tier

Assessing every vendor at the same depth makes coverage worse, because low-risk relationships spread analyst hours thin. Depth should follow the vendor’s tier, with outside-in data doing the first pass so analysts spend their time where risk is real.

The table below shows a sample mapping of tiers to assessment depth that you can adjust to your own risk appetite:

Use continuous monitoring between assessments

Continuous monitoring scans each vendor's external footprint on an ongoing basis and updates its security rating as conditions change. It catches events such as expired certificates, newly exposed services, and public breach disclosures.

Set alerts so a meaningful drop in a vendor's rating triggers an early reassessment. Your annual review then becomes a scheduled check-in, while ongoing signals cover what happens in between.

How UpGuard helps you assess third-party risk

UpGuard Vendor Risk combines security ratings from continuous outside-in scanning with questionnaire automation and AI evidence analysis. You can tier vendors by inherent risk and route each tier into workflows that set the right assessment depth.

When a vendor shares a SOC 2 report or completed questionnaire, evidence analysis helps you find gaps without reading every page by hand. Security ratings update as the vendor's external posture changes, so you see new issues between reviews.

Trust Exchange works from the vendor side, letting your vendors share their security posture proactively in a Trust Center. Sharing once cuts duplicate questionnaires and the time you spend waiting for responses.

St John Western Australia reports saving around 2,000 hours of assessment time with Vendor Risk, roughly two people’s work a year. Andrew Bullen, Manager of IT Security and Governance, said: “Third-party assessments could take up to 20 to 80 hours per vendor. With hundreds of vendors, it would take a team of two a full year to assess them all.”

To see how UpGuard Vendor Risk fits your program and accelerates third-party risk assessments, start a free trial.

Frequently asked questions

What should a third-party risk assessment include?

Start with the third party's inherent risk and evidence of its security controls, then verify that evidence against its external posture. Finish with contract terms and a residual risk decision that names remediation owners.

Who is responsible for third-party risk management?

A security or risk team usually runs the program, but the business owner of each relationship stays accountable for its risk. Mature programs name one TPRM owner and give legal and compliance teams defined review roles.

How often should you perform a third-party risk assessment?

Base the schedule on tier, reassessing critical vendors most often and lower tiers less often. Trigger an early review when a vendor's posture or ownership changes.

What is the difference between TPRM and a third-party risk assessment?

TPRM is the full program that governs third parties from discovery through offboarding. The assessment is one activity inside it, where you evaluate a specific relationship at a specific point.

What is a third-party risk assessment questionnaire?

It's a structured set of questions a third party answers about its security policies and controls, often based on the SIG or CAIQ. Its answers carry the most weight when you verify them against documents and outside-in data.