Third-party risk management (TPRM) is the process of identifying, assessing and reducing the risks that come from an organization’s suppliers, service providers and partners. In cybersecurity the focus is on suppliers that hold the organization’s data, connect to its systems or deliver software it relies on. The related term cybersecurity supply chain risk management (C-SCRM) covers risks across the whole life cycle of products and services.

How it works

• Inventory and tiering: list suppliers and rank them by the data and access they have.
• Due diligence: questionnaires, certifications, audit reports and technical checks before and during the contract.
• Contractual controls: security requirements, incident notification duties, audit rights and exit plans.
• Continuous monitoring: watching for changes, incidents and new exposure throughout the relationship, not only once a year.

Regulations such as NIS2 and DORA make supply chain and ICT third-party risk an explicit duty.

Why it matters for dark web monitoring

Many breaches start at a supplier. Questionnaires show what a vendor says it does; external evidence shows what is happening. Leaked supplier credentials, data from a vendor offered for sale, or ransomware claims that name a partner are early warnings of a supply chain attack. Adding such signals to vendor reviews is the idea behind third-party intelligence.

Sources: NIST CSRC: Cybersecurity Supply Chain Risk Management (C-SCRM), NCSC: Supply chain security guidance