Published October 27, 2026
What a third-party risk program is
A third-party risk program finds every outside party the organization relies on, reviews each in proportion to its risk, writes protections into the contract, monitors the relationship and ends it cleanly.
A detailed public description is the Interagency Guidance on Third-Party Relationships, issued in June 2023 by the Federal Reserve, the FDIC and the OCC. It is written for banks, and it is guidance, not law. It sets out five life cycle stages: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination. It says using a third party does not diminish the organization's responsibility to meet its obligations as if it did the work in-house. It also says a third-party relationship can exist without a contract or payment. In September 2026 the agencies and the NCUA proposed guidance that would replace the 2023 guidance once final.
Other frameworks and rules cover the same work. NIST CSF 2.0 has a category for it, GV.SC, with ten outcomes from strategy to post-contract activities. SEC Regulation S-K Item 106 asks public companies to describe whether they have processes to oversee and identify cybersecurity risks from third-party service providers. New York's 23 NYCRR 500.11 requires written policies for third-party service providers. SOC 2 criterion CC9.2 says the entity assesses and manages risks associated with vendors and business partners. In the EU, DORA has applied since January 17, 2025.
How much review each vendor gets
The central decision is tiering. The interagency guidance says not all relationships present the same level of risk, and oversight should be more rigorous for those that support critical activities. It describes critical activities as those that could cause significant risk if the third party fails, have significant customer impacts, or significantly affect financial condition or operations. Each organization decides which of its activities are critical.
A workable tiering test asks four things about each vendor. Does it hold or reach your confidential or customer data? Does it connect to your systems or network? Would its failure stop a service customers depend on? Is it hard to replace within the notice period? A vendor with no to all four gets a light review. A vendor with yes to the third or fourth is a candidate for the top tier, whatever the contract value.
The options
| Review level | What it involves | Fits |
|---|---|---|
| Light | An inventory record, a named business owner, sanctions and basic checks, standard contract terms. | Vendors with no data access, no system connection and easy replacement. |
| Standard | A standard questionnaire or an independent report, such as a SOC 2 type 2 or the vendor's CSA STAR entry, read against the services you buy. | Vendors that hold some data or connect to systems but do not support a critical activity. |
| Full | The above plus financial condition, business continuity and recovery testing, penetration test results, subcontractors, and negotiated contract terms. Board approval may apply. | Vendors that support critical activities or hold sensitive data at scale. |
The Cloud Security Alliance publishes the CAIQ, a yes or no questionnaire on the controls in IaaS, PaaS and SaaS services, and a public STAR Registry of provider entries. The interagency guidance allows industry utilities or consortiums to supplement due diligence. It says to evaluate their conclusions against your own circumstances.
The order of the work
- Write the policy and the tiering test. Get the risk appetite and the approval route agreed before reviewing anyone.
- Build the inventory. Pull from accounts payable, procurement, contract repositories, single sign-on logs and expense reports. Include relationships with no contract and no payment.
- Tier every vendor. Record the answer to each tiering question so the tier can be checked later.
- Review the top tier first. Start with existing critical vendors.
- Put intake in front of procurement. New vendors get tiered and reviewed before signature, not after.
- Track findings to closure. Each finding gets an owner on both sides, a date and a decision: fixed, accepted or exit.
- Set monitoring by tier. Decide what is reviewed each year, what triggers an early review, and who watches for incidents and financial changes.
- Plan exits for critical vendors. Name the alternative, the transition time and the data return before you need them.
What takes longer than expected
- The inventory. Vendors bought on cards, free tools, data-sharing partners and affiliates can be missing from procurement records. The guidance counts referral arrangements, affiliates and joint ventures as third-party relationships.
- Getting answers from vendors. A vendor may refuse site visits or decline to share information you request. The guidance says to document the limitation, understand the risk and offset it with other information, extra controls or a different vendor.
- Remediation. Unless the contract requires remediation, findings on a vendor's controls get fixed on the vendor's timetable.
- Contracts already signed. Existing contracts lack the clauses you now want. They change only at renewal or by negotiation.
The detail plans leave out
- Report scope. The guidance says to check that a SOC report's scope and results are relevant to the activity. Read the exceptions, and run the controls the report assigns to customers.
- Subcontractors. A CC9.2 point of focus extends the risk assessment to the vendor's own vendors and business partners. The guidance suggests contract terms on notice of subcontracting, prohibited subcontractors and consent to assignment.
- Incident planning. CSF 2.0 GV.SC-08 calls for relevant suppliers to be included in incident planning, response and recovery. Put critical vendors' contacts and notice duties in the incident response plan.
- Offboarding. GV.SC-10 covers activities after a contract ends. The guidance lists data retention and destruction, system connections and access control. Remove accounts, keys and network paths, and get written confirmation of data return or destruction.
- Concentration. The guidance puts dependency on one provider for multiple activities in board reporting.
The contract and compliance angle
After signature, the contract sets what you can require of a vendor. The interagency guidance lists provisions to consider, scaled to risk, including:
- The right to audit, or to receive named reports such as SOC reports, and to require remediation.
- Notice of security breaches, with the expected effects and corrective action.
- Notice of mergers, acquisitions, new subcontractors and key personnel changes.
- Business continuity duties, including recovery time and recovery point objectives and joint testing.
- Limits on liability in proportion to the possible loss, and insurance.
- Termination terms that allow an orderly transition, return or destruction of data, and assignment of transition costs.
For New York DFS covered entities, 500.11 requires guidelines on vendors' access controls including multi-factor authentication, encryption in transit and at rest, notice of cybersecurity events, and representations and warranties on cybersecurity. DORA requires EU financial entities to keep a register of information on all contracts for ICT services from third-party providers, marking those that support critical or important functions.
Skills and operations
The guidance allows the program to sit centrally, under compliance, security, procurement or risk, or to be spread across business lines. Either way, each vendor needs a business owner, and the review needs security, legal, privacy and finance input scaled to the tier.
Keep the records the guidance lists: a current inventory that marks critical relationships, risk assessments, due diligence results, executed contracts, remediation plans, monitoring reports, incident reports from vendors, and board reports. Arrange a periodic independent review of the program itself.
Track the intake queue: how many new vendors are waiting for review, and for how long. A growing queue means review capacity is short, and business units may sign before review.
Settle these first
- Which rules apply to you: SEC disclosure, NYDFS, DORA, SOC 2 commitments, or customer contracts?
- What is the tiering test, and who can override a tier?
- Who owns each vendor relationship, and who approves top-tier contracts?
- Which sources will build the inventory, and how will new vendors be caught at intake?
- Which reports and certifications will you accept in place of a questionnaire?
- What happens when a vendor refuses to answer or to fix a finding?
Questions
- What are the stages of the third-party risk management life cycle?
- The 2023 interagency guidance names five: planning, due diligence and third-party selection, contract negotiation, ongoing monitoring, and termination.
- Does every vendor need a security questionnaire?
- No. The interagency guidance says oversight should match the risk of each relationship. Vendors with no data access, no system connection and easy replacement can get a light review.
- Can a SOC 2 report replace a questionnaire?
- It can, for the services it covers. The guidance says a bank may consider SOC reports and independent certifications in due diligence. Check that the report's scope matches the services you buy and read the exceptions.
- What is fourth-party risk?
- Risk from your vendors' own vendors. A point of focus under SOC 2 criterion CC9.2 includes them in the vendor risk assessment, and the interagency guidance covers them as subcontractors.
- Do public companies have to disclose third-party risk processes?
- SEC Regulation S-K Item 106 asks registrants to describe, as applicable, whether they have processes to oversee and identify cybersecurity risks from third-party service providers.