Third-Party Risk Management (TPRM) Policy

Version: 1.0 | Last updated: [Date] | Document owner: [Responsible role, e.g., CISO / Risk Manager]

1. Purpose

This policy establishes the requirements for identifying, assessing, monitoring, and mitigating risks associated with vendors, partners, and service providers that have access to [Company Name]'s data, systems, or facilities.

2. Scope

Applies to all vendors, subcontractors, and business partners who process company data, have access to internal systems, or provide services critical to operations, regardless of contract size.

3. Vendor Classification

Every vendor must be classified into one of three risk tiers before onboarding:

• Tier 1 — Critical: access to sensitive data (personal, financial, intellectual property) or systems essential to operations.
• Tier 2 — Relevant: limited access to data or systems, without direct operational criticality.
• Tier 3 — Low risk: access only to public information or no access to company systems/data.

4. Due Diligence Process

• Tier 1 vendors: full security questionnaire aligned with recognized frameworks (ISO 27001, NIST CSF), evidence request (certifications, audit/pentest reports, signed policies), and external technical assessment where applicable.
• Tier 2 vendors: simplified questionnaire and validation of basic controls (MFA, encryption, access management).
• Tier 3 vendors: standard confidentiality contract clauses, no additional technical assessment.

No contract with a Tier 1 or Tier 2 vendor should be signed before the corresponding due diligence is complete.

5. Mandatory Contractual Clauses

Every contract with Tier 1 and Tier 2 vendors must include: confidentiality and data protection obligations, right to audit, mandatory security incident notification within [timeframe, e.g., 48 hours], and termination clause for failure to meet security requirements.

6. Continuous Monitoring and Reassessment

• Tier 1 vendors: mandatory annual reassessment, with continuous monitoring of external risk signals (technical exposure, public breaches, reputation).
• Tier 2 vendors: reassessment every [18–24 months].
• Tier 3 vendors: review only upon material change in service scope.

7. Roles and Responsibilities

• [Role, e.g., Procurement Manager]: ensures no vendor is onboarded without prior risk classification.
• [Role, e.g., CISO/Security Team]: conducts and approves technical assessments for Tier 1 and Tier 2 vendors.
• [Role, e.g., Contract Owner]: monitors contractual obligations and reports incidents involving the vendor.

8. Non-Compliance

Failure by a vendor to comply with this policy may result in suspension of system access, contract review, or termination, depending on the severity of the identified risk.

9. Policy Review

This policy must be reviewed every 12 months or after relevant regulatory changes (e.g., changes to GDPR, CCPA, or applicable sector regulations).