Third-Party & Vendor Risk
Part of the Cybersecurity Roadmap
In short
You can lock down your own systems perfectly and still get breached through a vendor. Every outside company you share data or access with becomes part of your security.
Assessing and managing security risk introduced by external vendors and partners — a company's security posture is only as strong as its weakest connected third party, a lesson learned from many real breaches.
Think of it like this
The society's hired security agency
Your housing society hires a guard agency. If their guard sleeps or lets strangers in, it is your flat that gets robbed, not the agency's office. So you check the agency before signing, put duties in the contract and keep an eye on them.
Watch it happen
A vendor's life with you
1/6List every vendor: payroll SaaS, cloud host, the agency with VPN access. Shadow tools count too.
The big ideas
What you need to know
Effort follows tier
You cannot deeply audit 200 vendors. Spend effort on the few that hold sensitive data or have network access.
Ask for evidence
A questionnaire answer of "yes, we encrypt" is a claim. A recent audit report or certificate is evidence.
Least access for vendors
Give vendors only the access they need, for as long as they need it, and log what they do.
Fourth parties exist
Your vendor has vendors too. Ask who they share your data with, because a breach there still reaches you.
Save yourself the pain
Common mistakes
Oops
Assessing a vendor once at signing and never again.
Do this instead
Vendors change owners, tools and staff. Reassess high tier vendors at least yearly and after any incident.
Oops
Forgetting to remove a vendor's access when the contract ends.
Do this instead
Make offboarding a checklist step: disable accounts, rotate shared secrets, confirm data deletion in writing.
Your mission
Audit your own app vendors
Quick check
Which vendor deserves the deepest security assessment?
Go deeper
- 1Draft a basic vendor security questionnaire covering data access and security controls.
- 2Learn why supply chain attacks through a trusted vendor are an increasingly common breach vector.
- 3Understand why ongoing vendor monitoring matters, not just a one-time onboarding assessment.
More topics at this stop
Risk Assessment & Management
Security Frameworks (NIST, ISO 27001)
Compliance Standards (SOC 2, GDPR, HIPAA, PCI-DSS)
Security Policies & Procedures
Security Awareness Training
Business Continuity & Disaster Recovery Planning
Audit Basics
Building a Risk Register
Stuck on this topic? Ask an Insider
Get 1:1 guidance from people who've walked this exact path — on the InsideEdge app.
