Third-Party Risk Management, Defined
Third-party risk management is the practice of finding, assessing and controlling the security and operational risks that come from the outside parties an organisation relies on. Those parties include suppliers, software vendors, cloud services, contractors and their subcontractors. Its aim is to stop a partner’s breach or failure from becoming your own.
For most organisations the perimeter now runs through other companies. Your payroll, your customer data and your core systems often sit with a vendor and each connection is a way in. In its 2026 Data Breach Investigations Report, Verizon found that 48% of breaches involved a third party, up from 30% the year before.
That is why vendor risk management and supplier risk management, terms you will see used for the same idea, have moved from a procurement checkbox to a board-level concern.
How Third-Party Risk Gets In
Third-party risk is not one thing. It enters through a handful of everyday routes and knowing them tells you where to look.
- Vendor access: A supplier with a login or a network connection can be phished and their access becomes the attacker’s access.
- Trusted software: An update from a vendor you trust can carry hidden malicious code, signed and delivered through the normal channel.
- Shared services and data: When a SaaS provider or data processor holds your data, their breach exposes it whether or not your own systems are touched.
- Subcontractors: Your supplier’s own suppliers can fail in ways you never see because you have no direct contract with them.
These routes are widening because software flaws are being exploited faster. In the same 2026 report, Verizon found that exploiting a vulnerability is now the most common way attackers first get in, ahead of stolen credentials for the first time in the report’s 19-year history. A single flaw in a widely used vendor product can reach thousands of that vendor’s customers at once.
Types of Third-Party Risk
Third-party risk shows up in more than one form and a single vendor can carry several at once.
- Cybersecurity risk: A third party with weak security becomes an open door to your systems and data.
- Operational and concentration risk: If a critical supplier goes down your service goes down with it and the danger grows when many organisations lean on the same provider.
- Compliance and data-protection risk: A supplier that mishandles regulated data can put you in breach of the law because the duty stays with you.
- Financial and reputational risk: A supplier’s failure or breach can cost you money, customers and trust even when the fault was theirs.
- Fourth-party risk: The risk you inherit from your suppliers’ own suppliers and subcontractors which you rarely see and never contract with directly.
The Business Impact
When a third party is the way in, the damage is not smaller for being someone else’s fault. It is usually larger and slower to clear up.
IBM’s 2025 Cost of a Data Breach Report put the average cost of a breach involving a third-party or supply-chain compromise at 4.91 million dollars. Those breaches also took the longest of any type to identify and contain, 267 days, against a global average of 241 days across all breaches.
The cost is not only the clean-up. A supplier breach can force you to notify regulators and customers, halt operations while systems are isolated and defend against claims, all on a timeline you do not control because the investigation sits with the vendor.
Real-World Cases
The pattern is easiest to see in cases that are now well documented. Each of the four below entered through a third party and each points to a control that would have limited it.
Target and the HVAC Contractor (2013)
Attackers did not break into Target directly. They phished Fazio Mechanical Services, a heating and refrigeration contractor with a login to a Target supplier portal, and stole its credentials.
With that foothold they reached Target’s network around 15 November 2013, moved across to the checkout systems and installed malware that skimmed card data. About 40 million card accounts and personal data on up to 70 million customers were exposed. The clean-up cost Target roughly 292 million dollars in gross expenses, about 90 million of which insurance recovered, leaving a net cost of around 202 million dollars.
The lesson is about access, not the contractor. A vendor login for billing should never have been able to reach payment systems. Segmenting the network and giving each third party the least access it needs would have kept the intruders boxed in.
SolarWinds and a Poisoned Update (2020)
SolarWinds sold Orion, a widely used IT-monitoring tool. A nation-state group, attributed by the US and UK governments to Russia’s foreign intelligence service, broke into the company’s software build system and hid a backdoor called SUNBURST inside genuine, digitally signed Orion updates.
Around 18,000 customers downloaded the tainted update between March and June 2020. The attackers pursued only a much smaller, hand-picked set of targets, later estimated at fewer than 100 including US federal agencies. CISA ordered agencies to disconnect Orion in Emergency Directive 21-01.
This is the hard case. The malware arrived from a trusted vendor through the front door, correctly signed, so ordinary vulnerability scanning saw nothing wrong. Defending against it means treating even trusted vendor software as something to verify and monitor rather than wave through.
MOVEit and Mass Data Theft (2023)
In late May 2023 the Clop ransomware group found a zero-day flaw in MOVEit Transfer, a file-transfer product from Progress Software that organisations use to move sensitive files. They exploited it to steal data straight from MOVEit databases before most customers knew a flaw existed.
Thousands of organisations were caught and many were downstream victims. Their data was breached not because they ran MOVEit but because a payroll firm, a pension administrator or another supplier did. CISA and the FBI issued a joint advisory, AA23-158A, on 7 June 2023.
The flaw was Progress’s, but the exposure landed on its customers and their customers. Limiting that kind of damage comes down to knowing which suppliers hold your data and what software they run, writing fast-patching and breach-notification duties into their contracts and sharing as little data as the job allows.
Miljödata and 200 Swedish Municipalities (2025)
In August 2025 ransomware hit Miljödata, a Swedish supplier whose HR, sick-leave and incident-reporting systems are used by around 80% of the country’s municipalities. The attack was detected on 23 August and disrupted services across roughly 200 of Sweden’s 290 municipalities and regions.
Affected regions warned residents that sensitive personal data, including health-related records, might have been exposed. The attackers reportedly demanded about 1.5 bitcoin, a modest sum for damage on this scale. One supplier had quietly become a single point of failure for much of Swedish local government.
No amount of internal security would have helped the municipalities here, because the weak point sat inside a shared supplier. The defence is to map which suppliers are critical, demand tested security and continuity from them and keep a manual fallback so a single outage does not stop essential services.
Third-Party Risk Management and Compliance
Managing third-party risk is no longer only good practice. Across the EU and Sweden it is written into law and the duty to check your suppliers rests with you rather than them.
NIS2 and Cybersäkerhetslagen
The EU NIS2 Directive became Swedish law as Cybersäkerhetslagen (SFS 2025:1506) on 15 January 2026. Article 21 lists the security measures in-scope entities must take and 21.2d names supply-chain security specifically. Article 20 makes the board responsible for these measures and lets regulators hold board members personally accountable.
Serious incidents must be reported to NCSC at FRA, the national single point of contact and CSIRT since 1 July 2026, together with the relevant sector authority, with an early warning inside 24 hours, an incident notification inside 72 hours and a final report inside one month. Fines reach up to 10 million euro or 2% of global turnover for essential entities.
DORA
For financial entities the Digital Operational Resilience Act (DORA) has applied since 17 January 2025, supervised in Sweden by Finansinspektionen. Its starting point is blunt. Outsourcing a service does not outsource the risk.
DORA requires firms to keep a Register of Information that lists every ICT third-party arrangement and to report it to the regulator. They must also run pre-signing due diligence, assess concentration risk and use only providers that meet appropriate security standards. Article 30 sets the security, incident-support, audit and exit clauses every ICT contract must contain.
The most systemically important providers can be placed under direct EU oversight as Critical ICT Third-Party Providers.
GDPR
Where a supplier handles personal data, the GDPR treats that supplier as your processor. Under Article 28 you may use only processors that give sufficient guarantees of security under a written data processing agreement and a processor cannot bring in a sub-processor without your approval.
If that supplier suffers a breach, the duty to notify the Swedish authority IMY within 72 hours is still yours under Article 33.
ISO 27001
ISO/IEC 27001, the international standard for information security management, gives you a ready-made framework. Its 2022 version dedicates a group of Annex A controls to suppliers, A.5.19 to A.5.23, covering a supplier security policy, security clauses in agreements, ICT supply-chain security, ongoing monitoring of supplier services and cloud-service security.
Control A.5.21 reaches past the direct supplier to the ICT supply chain behind it which is where fourth-party risk lives. Certification is a clear way to show customers and regulators that your third-party risk management holds up.
How to Assess a Third Party
A third-party risk assessment answers a simple question before you trust a supplier. How much risk does the relationship carry and can you live with it?
- Inventory. List every third party and what each can access from network connections to the data they hold. You cannot manage what you have not listed.
- Tier by risk. Rank suppliers by how much damage they could cause so a payroll processor gets more scrutiny than a stationery supplier.
- Do due diligence. For higher-risk suppliers, review their security controls, certifications, breach history and data locations and ask how they manage their own suppliers.
- Get it in writing. Put security standards, breach-notification timelines, audit rights and exit terms into the contract before you sign.
- Reassess. Recheck on a schedule set by risk and again after any major change or incident, because a supplier’s security is not fixed.
Be honest about the limits. A questionnaire or a certificate is a snapshot of one moment rather than proof that a supplier is secure today or will be tomorrow. SolarWinds and MOVEit were both trusted, vetted vendors when they were compromised. Assessment reduces risk but does not remove it so pair it with monitoring and with access controls that limit the damage when a supplier fails.
How to Build a Third-Party Risk Management Program
A third-party risk management program turns those one-off checks into a routine the organisation runs all the time. It rests on people, process and technology working together.
Give it an owner and a mandate. Someone senior needs to own third-party risk, report on it to the board and have the authority to say no to a risky supplier. Under NIS2 that oversight is now the board’s legal responsibility rather than a formality.
- Keep a live inventory of every third party and the access and data each one holds.
- Tier suppliers by risk and match the depth of due diligence to the tier.
- Grant least privilege. Give each supplier the narrowest access it needs for only as long as it needs it.
- Segment your network so a single vendor account cannot reach your crown-jewel systems.
- Write security, breach-notification and exit terms into every contract, and check they are met.
- Monitor continuously rather than trusting an onboarding review to hold.
- Map concentration risk. Know where one supplier or one supplier’s supplier, is a single point of failure.
- Plan for supplier incidents and outages, and keep a fallback so essential services continue.
None of this needs to be perfect on day one. Start with two things, the inventory and your highest-risk suppliers. Get the contract terms right, then build monitoring around them. In every case above, the breach spread because a supplier could reach something it should not have. A program is how you make sure yours cannot.
