Reporting and analysis on the standards, companies, products, incidents, and research changing third-party risk decisions.
Shared Assessments scopes SIG Lite, Core, and custom questionnaires around third-party risk and inherent-risk needs. Cloud Security Alliance builds CAIQ into its cloud-focused Cloud Controls Matrix. Select from the relationship, technology, respondent, control scope, artifact version, and evidence need.
CyberVadis says a shared scorecard exposes assessment results and an improvement plan, while each supporting document has its own sharing setting. Reviewers need a recipient-specific disclosure receipt that shows which scorecard version and evidence files were actually accessible, when access began, and when it ended.
HHS ties the HIPAA Security Rule to electronic protected health information created, received, used, or maintained by a covered entity or business associate. A third-party-risk tier can set review depth, but the defensible scope record must follow the actual ePHI path, regulated role, safeguard responsibility, and retained evidence.
Venminder presents lifecycle software, outsourced control assessments, and continuous risk monitoring as connected parts of its offer. A buyer still needs a handoff record that distinguishes the evidence the platform held, the work an analyst performed, the monitoring signal received, and the decision the customer retained.
Dun & Bradstreet presents identity-anchored business data for embedded AI, connectors, agents, APIs, and feeds. A governed third-party workflow still needs to retain the submitted identity, candidate set, selected entity, relationship evidence, data snapshot, rule or model version, and reviewer disposition behind every match.
Resolver describes a repository that can hold one vendor with several service engagements and says each engagement receives its own evaluation. Buyers should preserve separate intake, vendor, engagement, evidence, condition, approval, and reassessment records so a decision about one service is not silently reused for another.
Exiger says a red flag can be escalated into deeper due diligence. The transition should preserve the trigger, prior evidence, new scope, authority, sources, owner, timing, outcome, and downstream decision instead of turning one click into an unexplained change of investigative purpose.
Supply Wisdom lists cascading impact warnings alongside configurable alerts drawn from multiple sources. A warning about downstream impact becomes decision-ready only when the buyer can reproduce every relationship hop from the observed event to the specific third party, service, internal dependency, and accountable owner without treating a possible network path as confirmed exposure.
The European Banking Authority published final third-party-risk guidelines for non-ICT services on September 18, 2026, but its authority page still marks them not yet applicable. EU financial firms can map affected critical or important arrangements now while retaining the applicable 2019 outsourcing baseline until the replacement takes effect.
Archer says its vendor workflow sends a secure response link outside the buyer's instance, lets vendor contacts invite colleagues to help, and synchronizes their answers back to the engagement. Collaboration can speed evidence collection, but each answer still needs a named respondent, delegated authority, source attachment, version, attestation, and buyer disposition before it can support a third-party-risk decision.
Diligent says its 3rdRisk virtual assistant lets users receive alerts, complete tasks, and interact with workflows from Microsoft Teams and Slack. That convenience needs a precise return path: the governed risk record must show who acted, under which role, on what evidence and version, with what decision meaning, and whether the source system accepted the action once.
RapidRatings says its FHR uses public and private company financial statements to surface supplier strengths, weaknesses, and early signs of distress. A rating can focus review, but a defensible third-party decision still needs the rated legal entity, statement period, dependency, and action threshold recorded together.
NIST's final July 2026 quick-start guide separates foreign influence, provenance, resilience, foundational cyber practices, and supply-chain tiers in ICT supplier assessment. A single supplier score cannot show which of those questions was evidenced, unresolved, or relevant to a specific acquisition.
SAP's current base-edition record lists several productive tenants but identifies a test tenant for SAP Ariba Supplier Risk. A supplier-risk test is decision-ready only when its tenant, configuration, data population, scenario, result, approval, and production consequence remain explicit.
Four federal banking agencies requested comment on non-binding, principles-based third-party risk management guidance on September 11, 2026. The proposal would replace existing interagency guidance only if finalized, while a separate statement and Federal Reserve community-bank guide create distinct records that institutions should not collapse into one current requirement.
Panorays says Risk DNA combines business criticality, external and internal assessments, relationship context, and an organization's risk appetite. A changing contextual score can support prioritization only when the inputs, weights, matrix, evidence, and effective time behind each result remain reproducible.
SecurityScorecard's TPRM guidance says a portfolio can include current partners, possible future partners, competitors, and other businesses with risk implications. Before teams report a portfolio as vendor scope, every entry needs an explicit relationship state and every metric needs a declared population rule.
UpGuard documents an Excel export that includes the optional columns currently shown on the Vendors page. That file can serve as a point-in-time operating artifact only when its view, filters, columns, meanings, row population, permissions, extraction time, and integrity remain reproducible.
Vanta says its third-party risk management agent can pull findings from SOC 2 reports, data-processing agreements, questionnaires, and custom security terms. That extraction can support review only when every term remains tied to the exact document, clause, party, service, effective period, interpretation, reviewer, and resulting decision.
RiskRecon describes continuous vendor security monitoring tuned to a buyer's risk policy. That monitoring can support triage only when the observed internet-facing assets are reconciled to the right vendor, service, contract, and review scope, with exclusions and ownership changes retained.
Censinet offers self-directed, hybrid-support, and fully managed operating models for healthcare third-party risk. Buyers still need an activity-by-activity record of who performs the work, who supplies evidence, who decides, and who remains accountable when a finding moves into remediation.
LogicGate says its third-party-risk agents can triage vendor requests, evaluate questionnaires against a control framework, and create linked findings ready for remediation while practitioners stay involved in approvals. Buyers still need source evidence, agent and policy versions, reviewer judgment, overrides, disposition authority, and downstream action receipts.
MetricStream says third-party profiles can combine contracts, issues, assessments, risk ratings, and business relationships, while KPI scores cover cost, delivery, service, and quality. Those scores can focus attention, but buyers still need the source measures, population, formula, thresholds, missing-data state, service scope, and exception decisions behind each result.
Risk Ledger describes a collaborative supplier network in which organizations can share intelligence and respond to emerging threats. Reuse can shorten discovery time, but a community observation still needs attributable origin, scoped applicability, sharing permission, correction history, and a buyer-owned disposition before it becomes relationship evidence.
Black Kite presents third-party cyber intelligence that includes transparent ratings, ransomware susceptibility, continuous monitoring, and the financial impact of cyber risk. A monetary estimate can focus review, but it is defensible only when the modeled event, affected service, exposure assumptions, evidence cutoff, uncertainty, and decision use remain visible.
UpGuard describes vendor tiers as classifications of inherent risk that can determine assessment depth and can be assigned manually or through rules based on relationship-questionnaire responses. A tier can organize diligence, but it remains defensible only when the relationship facts, rubric version, evidence, reviewer, effective period, and prior classification stay reconstructable.
Aravo describes a TPRM platform that can integrate findings from many risk-intelligence providers into a third party's evaluation and score. Consolidation can accelerate review, but it does not make conflicting entity matches, observation dates, methods, or source conclusions equivalent.
ServiceNow positions third-party risk inside an enterprise workflow that can connect monitoring, issues, remediation, reporting, and offboarding. Closing a remediation task can prove that assigned work reached a configured state, but it does not by itself establish that the underlying finding was corrected, independently verified, or accepted by an authorized risk owner.
Protecht documents a secure vendor workspace for documents, tasks, and questionnaires, alongside automated evidence collection and AI-assisted assessment. A completed response can move diligence forward, but it should not become validated assurance until every artifact retains its source, scope, version, attestor, validity period, and review history.
Ncontracts presents vendor management for financial institutions with onboarding, due diligence, risk assessments, contract management, ongoing monitoring, and exit support. A renewal date can organize commercial work, but it should not reset, extend, or stand in for the evidence and authority behind a third-party risk decision.
ProcessUnity describes continuous vendor monitoring, external intelligence connectors, alerts, issue management, and role-specific reporting. Those capabilities can surface a changed condition quickly, but an alert becomes decision evidence only when the affected relationship, source state, review, authority, and resulting action remain linked.
Certa describes an automated decision engine based on preset risk factors, paired with workflow routing, escalation, and detailed audit trails. That architecture can make routine decisions faster, but a defensible result still needs the exact rule version, inputs, exception path, and authority that produced it.
Mitratech presents Prevalent as a third-party risk management environment spanning vendor intake, contracts, assessment, monitoring, remediation, and offboarding. Closing that workflow can document the end of a relationship, but it does not by itself prove that accounts, tokens, integrations, facilities access, retained data, and downstream dependencies were actually terminated.
Bitsight describes daily security ratings, continuous third- and fourth-party monitoring, assessments, and evidence workflows. An outside-in signal can prioritize review, but it cannot by itself establish which internal control exists, how it is configured, whether it operated, or whether the buyer should accept the risk.
OneTrust describes a centralized third-party inventory connected to onboarding, assessments, monitoring, and reporting. A legal-entity profile can organize work while the buyer still has to identify the products, services, integrations, locations, data, and downstream parties that create the actual dependency.
Whistic presents reusable security profiles, governed evidence sharing, and questionnaire response as ways to reduce repeated assessment work. The buyer still has to decide whether the evidence fits the relationship, control scope, and risk appetite.
Section 500.11 connects third-party identification, minimum practices, due diligence, periodic reassessment, and contract guidance instead of treating a questionnaire as the whole control.
The community-bank guide says unavailable due-diligence evidence should lead to alternative information, controls, or monitoring—not an unexplained pass or a silent stop in the review.
Article 29 puts substitutability, repeated reliance on the same or connected providers, alternative solutions, and subcontracting risk into the assessment before critical ICT services are contracted.
For material outsourcing, the current supervisory statement treats exit as a planned, owned, costed, and risk-based test—not a clause that can wait for supplier failure.
Article 21 puts supply-chain security inside the risk measures for essential and important entities. A supplier score cannot replace the entity's own relationship-specific controls.
Federal banking agencies apply third-party risk principles across relationship types and structures. The operating record must explain how each arrangement works.
NIST's cyber supply-chain guidance does not reduce third-party risk to an onboarding questionnaire. It connects products, services, suppliers, system context, and risk response across the life of the relationship.
DORA's current register templates require more than a vendor list. Financial entities need connected contract, service, function, and subcontractor records.
API availability and questionnaire-remediation changes suggest that downstream visibility is being judged less as a map and more as data that must enter governed work.
ISO/IEC 27036-1 remains the published supplier-relationship standard while its 2026 review determines whether the current edition should be confirmed, revised, or withdrawn.
The finalized C-SCRM quick-start guide gives organizations a clearer floor for evaluating technology suppliers before risk teams build a larger program around it.
The vendor-funded analysis shows the value—and the limits—of using relationship-scale datasets to understand concentration and downstream cyber exposure.
APRA's operational-risk standard now requires regulated entities to connect material service-provider oversight with critical operations, formal agreements, monitoring, and continuity planning.
SP 800-18 Revision 2 treats cybersecurity supply-chain risk planning as part of the broader system risk record, raising the importance of traceable ownership and evidence.
A compromised third-party integration involving Klue and Salesforce shows why application connections need their own inventory, ownership, and revocation playbook.
The acquisition extends a broader contest over who can map external assets, dependencies, and threat signals into a third-party decision workflow.
The April package adds limited contractual exemptions, clarifies their management, and updates the material service-provider register ahead of the July commencement date.
The announced integration joins corporate ownership and trade intelligence with component- and material-level sourcing data, pushing third-party analysis deeper into product-specific exposure.
The UK policy expands reporting beyond outsourcing, separates notification from register templates, and gives firms a year to govern the data behind material third-party arrangements.
The new rating approach reflects a market shift toward combining external signals with evidence from the organization's own assessment and control process.
ProcessUnity and Ponemon Institute report a gap between incident volume and assessment response, but buyers should separate the study's directional signal from a universal benchmark.
The 2026 study brings healthcare organizations, industry groups, and several control frameworks into one benchmarking program, creating useful peer context with important participation limits.
The partnership combines outside-in cyber signals with healthcare-specific assessment and advisory work, illustrating how managed TPRM providers are packaging intelligence into response workflows.
The Mirato deal connects corporate and trade data with AI-assisted assessment workflow, creating a broader risk-intelligence operating model whose post-acquisition packaging still requires scrutiny.
