Governance, Law & Compliance
Third-party risk
Risk created by external organizations that provide data, software, infrastructure, or services.
Example
A third-party model creates risks the purchasing company does not directly control.
Why it matters
It helps organizations account for problems that enter through suppliers and their dependencies.
You'll hear it
“Who else handles our information behind this service?”
Can you control it?
Sometimes
Sometimes. An organization can define or influence third-party risk through its policies, processes, contracts, and product choices. Individual users may have fewer controls.
Common questions
- Can a subcontractor create risk without a direct contract with us?
- Yes. Its role in handling information or running the service can still affect your organization.
- Is third-party risk only about cybersecurity?
- No. Reliability, privacy, legal responsibilities and service continuity can matter too.
- Can two suppliers share the same point of failure?
- Yes. They may both rely on the same outside service, reducing the protection gained from having two vendors.