The desk maintains the company database, reviews primary sources, separates provider statements from editorial conclusions, and writes market analysis for third-party risk leaders.
The Research Desk covers regulatory and standards changes, company moves, product releases, incidents, and original market data. Every article identifies the underlying source class and explains which statements are verified facts, company-reported claims, or Third Party Current analysis.
Provider profiles and comparisons use a shared taxonomy so readers can move from a news event to the affected company and capability record. A product announcement may create a dated change record without changing the comparative dataset until supporting evidence is reviewed.
API availability and questionnaire-remediation changes suggest that downstream visibility is being judged less as a map and more as data that must enter governed work.
ISO/IEC 27036-1 remains the published supplier-relationship standard while its 2026 review determines whether the current edition should be confirmed, revised, or withdrawn.
The finalized C-SCRM quick-start guide gives organizations a clearer floor for evaluating technology suppliers before risk teams build a larger program around it.
The vendor-funded analysis shows the value—and the limits—of using relationship-scale datasets to understand concentration and downstream cyber exposure.
APRA's operational-risk standard now requires regulated entities to connect material service-provider oversight with critical operations, formal agreements, monitoring, and continuity planning.
SP 800-18 Revision 2 treats cybersecurity supply-chain risk planning as part of the broader system risk record, raising the importance of traceable ownership and evidence.
A compromised third-party integration involving Klue and Salesforce shows why application connections need their own inventory, ownership, and revocation playbook.
The acquisition extends a broader contest over who can map external assets, dependencies, and threat signals into a third-party decision workflow.
The April package adds limited contractual exemptions, clarifies their management, and updates the material service-provider register ahead of the July commencement date.
The announced integration joins corporate ownership and trade intelligence with component- and material-level sourcing data, pushing third-party analysis deeper into product-specific exposure.
The UK policy expands reporting beyond outsourcing, separates notification from register templates, and gives firms a year to govern the data behind material third-party arrangements.
The new rating approach reflects a market shift toward combining external signals with evidence from the organization's own assessment and control process.
ProcessUnity and Ponemon Institute report a gap between incident volume and assessment response, but buyers should separate the study's directional signal from a universal benchmark.
The 2026 study brings healthcare organizations, industry groups, and several control frameworks into one benchmarking program, creating useful peer context with important participation limits.
The partnership combines outside-in cyber signals with healthcare-specific assessment and advisory work, illustrating how managed TPRM providers are packaging intelligence into response workflows.
The Mirato deal connects corporate and trade data with AI-assisted assessment workflow, creating a broader risk-intelligence operating model whose post-acquisition packaging still requires scrutiny.
