Third Party Risk Management

What is Third Party Risk Management (TPRM)?

Third Party Risk Management (TPRM) is the continuous process by which an organisation identifies, assesses, mitigates and monitors the risks posed by external parties, such as suppliers, service providers, integrators and consultants, throughout the entire relationship, from selection to termination. It is the application of risk management to everything you do not control yourself. In OT environments these risks are technical, operational and cyber-related at the same time: a maintenance contractor with remote access can stop a production line just as effectively as an attacker.

In an OT context, TPRM mainly means screening and continuously monitoring suppliers that have (remote) access to industrial systems, supply components or maintain software and firmware.

🧠 What exactly does TPRM do?

TPRM follows the life cycle of a supplier relationship through six core functions:

1. Identification - knowing who your third parties are, including their sub-suppliers (“fourth parties”) and the cloud platforms they rely on
2. Classification - a risk assessment per supplier based on access, impact and dependency
3. Due diligence - a pre-contract review of security, integrity, financial stability and compliance
4. Contractual agreements - recording requirements on security, audit rights, incident notification and subcontracting
5. Monitoring - periodic reassessment through questionnaires, assurance reports, audits or technical scans
6. Exit strategy - plans for a secure termination: revoking accounts, recovering data and being able to bring in a replacement

The difference from supplier security is mainly one of level. TPRM is the governance process that decides which suppliers are critical and how much control they receive; supplier security is the concrete set of measures per supplier, and supply chain risk describes the threats across the whole chain.

🔐 Which cyber risks do third parties introduce?

Well-known incidents show this is not theoretical. At the US retailer Target, attackers got in during 2013 using credentials stolen from a heating and refrigeration contractor. On 2 July 2021 the REvil group exploited a zero-day in the Kaseya VSA management software; through fewer than 60 affected IT service providers, up to around 1,500 businesses further down the chain were hit. The 3CX attack of 2023 even started at a fourth party: a trojanised installer of the X_TRADER trading software led to a compromised 3CX telephony app, and the same X_TRADER infection also reached organisations in the energy sector. According to the Verizon Data Breach Investigations Report 2025, a third party was involved in around 30 percent of breaches.

🏭 How does TPRM in OT differ from TPRM in IT?

In OT, third parties are physically and digitally interwoven with critical processes. Replacing them is hard: the supplier often knows the installation better than the owner does. That makes lock-in a risk category of its own, one you need to weigh at the procurement stage.

⚖️ Which laws and standards require TPRM?

These frameworks complement each other. NIS2 and the Dutch Cybersecurity Act place the duty on the customer, the Cyber Resilience Act on the manufacturer of the product, and IEC 62443-2-4 on the service provider that builds or maintains the system. Under DORA, the European supervisors EBA, EIOPA and ESMA designated the first critical ICT third-party providers on 18 November 2025, placing them under direct EU oversight.

🔧 How do you set up TPRM step by step?

1. Build a supplier register - link your asset inventory to suppliers, contracts, access routes and sub-suppliers.
2. Classify into tiers - three or four tiers are common, for example based on a business impact analysis.
3. Match the assessment to the tier - a questionnaire for low risk, an assurance report or certificate for medium risk, an audit or field inspection for critical suppliers.
4. Put requirements in the contract - refer to IEC 62443-2-4 or ISO 27001, and cover incident notification, audit rights, approval of subcontractors and exit.
5. Control access technically - access control through a jump server with PAM, personal accounts, MFA, least privilege and session recording.
6. Monitor continuously - track supplier activity with monitoring and anomaly detection, and record findings in the risk register.
7. Rehearse exit and failure - include critical suppliers in business continuity plans and incident exercises.

Typical values from practice:

Check what an assurance report actually covers. An ISAE 3402 report, comparable to SOC 1, addresses controls relevant to the financial reporting of the customers. For security, a SOC 2 report or an ISAE 3000 report is more appropriate. A Type II report tests operating effectiveness over a period of typically six to twelve months, a Type I report only the design at a single point in time.

✅ Which security measures belong to TPRM?

❓ Frequently asked questions

What is the difference between TPRM and supplier security?

Third Party Risk Management is the overarching process you use to decide which external parties pose which risk and how much control that requires. Supplier security is the concrete execution per supplier, such as contract requirements, access rules and monitoring. TPRM steers, supplier security delivers.

Is TPRM mandatory under NIS2 and the Dutch Cybersecurity Act?

Yes, NIS2 Article 21 requires essential and important entities to address the security of their supply chain. In the Netherlands, Article 10 of the Cybersecurity Decree turns this into a policy on supplier dependencies and periodic assessment of direct suppliers. A demonstrable TPRM process is the logical way to meet that requirement.

How often should you reassess a supplier?

The reassessment frequency in TPRM depends on the supplier’s risk tier. In practice, critical OT suppliers are reassessed annually and after every major change, while low-risk suppliers are often only reviewed at contract renewal. An incident at the supplier always justifies an interim reassessment.

Is an ISAE 3402 report enough to trust a supplier?

An ISAE 3402 report provides assurance on controls relevant to financial reporting, not primarily on cybersecurity. For the security of an OT service provider, a SOC 2 Type II report, an ISO 27001 certificate or an IEC 62443-2-4 certificate says more. Always check that the scope of the report covers the service you actually buy.

What are fourth parties in TPRM?

Fourth parties are the sub-suppliers of your direct suppliers, such as the cloud platform on which a supplier runs its remote service tool. An attack or outage at such a fourth party can affect your installation even though you have no contract with that party. TPRM therefore requires insight into subcontracting and contractual approval of new sub-suppliers.

Where do you start with TPRM in an OT environment?

Start TPRM in OT with an overview of every party that has access to your control systems, and by which route. Then classify the suppliers whose failure or compromise could stop the process, and bring their access into a controlled route with a jump server and MFA. That delivers the largest risk reduction for the least effort.

📌 In summary

TPRM maps which external parties influence your installations, assesses their risk by tier and secures the agreements through contracts, technology and monitoring. In OT this weighs extra heavily because of the long life of installations and the deep access of integrators and maintenance providers. NIS2, the Dutch Cybersecurity Act, ISO 27001 and IEC 62443-2-4 also make it a duty you must be able to demonstrate.

Third Party Risk Management is indispensable in OT for controlling supplier risk: not only through policy, but through monitoring, technical access control and a demonstrable duty of care.