Third-party risk management

Third-party risk management (in German Dienstleistersteuerung) is the process by which an organisation manages the information security and compliance risks posed by external service providers, cloud vendors and suppliers across the entire lifecycle of the business relationship. It starts with risk-based selection and onboarding due diligence, continues through contractual security agreements, and leads into continuous monitoring of the agreed safeguards. The goal is to ensure that the security requirements applied internally are also enforced along the supply and value chain, so that risks are not carried into the organisation through third parties.

At its core is a risk assessment of each individual provider: which data and systems does it process, what is their protection requirement, and what would be the impact of an outage or a compromise? On this basis, requirements are defined and evidenced, for example through certificates (ISO/IEC 27001), assurance reports (SOC 2, ISAE 3402), TISAX labels or security questionnaires. The question of sub-processors (fourth-party risk) is also critical, as is concentration on a few large providers, which can create cluster risk in the event of an incident.

With the NIS2 Directive and its transposition into German law, supply chain security becomes an explicit obligation: the management bodies of essential and important entities must take and oversee measures to manage supply chain risks. For financial entities, the DORA Regulation specifies the management of ICT third-party providers, including mandatory contractual content and a register of information. Effective third-party risk management is therefore at once a building block of the ISMS, of business continuity management and of regulatory compliance.