THIRD PARTYCURRENT
Market record

Third-party risk change ledger

A chronological record of material standards, company, product, incident, and research developments. Each entry preserves what changed, the source class, the market consequence, and the evidence boundary.

Supervisory risk update

ESAs flag non-EU provider and infrastructure dependencies

The European Supervisory Authorities' Autumn 2026 risk update identifies external dependencies, emerging technologies, and private credit as key EU financial-system vulnerabilities. It says reliance on non-EU providers and infrastructures could amplify geopolitical and operational disruptions and highlights concentration in non-EEA ICT providers.

Official joint supervisory risk update · European Banking Authority, ESAs Autumn 2026 risk update

Supervisory guidance publication

EBA publishes final non-ICT third-party-risk Guidelines, not yet applicable

The EBA announced final Guidelines on September 18, 2026. Its status page says they await translation and are not yet applicable; the 2019 outsourcing Guidelines remain listed as applicable and will be repealed only once the new Guidelines apply. The future application date and compliance deadline are not populated on the reviewed page.

Official EBA guidance-status page and press release · European Banking Authority, Guidelines on third party risk management

Product release

UpGuard adds fourth-party API access and questionnaire-remediation changes

UpGuard's release archive records new fourth-party data access and remediation workflow changes. The record establishes an announced product change, not independent proof of implementation depth or package availability.

Official company release record · UpGuard release archive

Standards lifecycle

ISO/IEC 27036-1 enters systematic review

ISO's lifecycle record shows the 2021 supplier-relationship standard entering systematic review. The review does not itself revise or replace the published edition.

Official standards lifecycle record · ISO standards record

Market research

UpGuard publishes a higher-education vendor breach study

UpGuard reported analysis of 515 universities, 105,006 vendor relationships, and about 5,400 suppliers. The provider-funded study should be interpreted within its disclosed dataset and method.

Provider-funded research announcement · UpGuard

Regulatory commencement

APRA CPS 230 enters force

APRA lists the updated operational-risk standard as in force from July 1, 2026. It connects service-provider oversight to critical operations, resilience, agreements, monitoring, and continuity.

Official prudential standard status · APRA CPS 230 standard page

Standards update

NIST publishes SP 800-18 Revision 2

NIST's revision coordinates security, privacy, and cybersecurity supply-chain risk management planning within the system risk record.

Government standard-setting authority · National Institute of Standards and Technology

Incident disclosure

OneTrust publishes an update on a Klue Salesforce integration incident

OneTrust said compromised OAuth tokens associated with a third-party integration were involved and stated that OneTrust customer tenants were not connected to the incident. The record is the company's account at the stated date.

Official company incident update · OneTrust

Acquisition

SecurityScorecard announces its acquisition of Driftnet

SecurityScorecard listed the Driftnet transaction in its company announcement archive. Later product evidence is required to establish the resulting packaging, integration, and buyer-visible workflow.

Official company announcement · SecurityScorecard press archive

Regulatory amendment

APRA finalizes targeted CPS 230 amendments

APRA finalized limited contractual exemptions, related practice guidance, and an updated Material Service Provider Register template before the standard's July commencement.

Official regulator amendment package · APRA operational-risk consultation record

Regulatory policy

PRA finalizes material third-party notification and register reporting

Policy Statement 7/26 expands reporting attention to material outsourcing and non-outsourcing third-party arrangements and sets March 18, 2027 as the implementation date.

Official prudential policy statement · Bank of England PRA Policy Statement 7/26

Product launch

ProcessUnity announces a controls-driven risk index

ProcessUnity describes its Risk Index as combining controls-based assessment information with externally observed data. The announcement establishes positioning, not independently verified accuracy or outcomes.

Official company announcement · ProcessUnity

Market research

ProcessUnity and Ponemon publish the 2026 State of Assessments study

ProcessUnity said the study included 1,465 respondents and reported continuing reliance on manual tools. Readers should inspect the full method before using promotional figures as universal benchmarks.

Provider-sponsored research announcement · ProcessUnity and Ponemon Institute

Acquisition

Sayari acquires Mirato

Sayari announced the acquisition of Mirato to connect its commercial and trade intelligence with AI-assisted TPRM orchestration technology.

Official company announcement · Sayari acquisition announcement