GUIDE · Third‑Party Risk Management
Know Which Suppliers Could Become Your Next Breach.
We assess, tier and monitor the vendors, MSPs and software providers that hold your data or connect to your systems.
- Visibility of supplier risk
- Fewer unmanaged privileged connections
- Defensible vendor decisions
- 1Define Scope and Criteria
- 2Build the Inventory
- 3Score and Tier
- 4Assess and Remediate
- 5Monitor and Offboard
Executive Summary
- 01Supplier risk is managed by access and criticality, not by contract value.
- 02An accurate inventory, including subcontractors, is the foundation every other control depends on.
- 03Contracts, validated evidence and controlled offboarding turn supplier findings into decisions you can defend.
The Challenge
Supply‑chain compromise through vendors, MSPs and software updates is one of the threats institutions face most often.
Most organizations do not know which suppliers have privileged access or how well those suppliers are protected.
The DAAKYI Approach
DAAKYI inventories third parties, tiers them by criticality and access, and applies proportionate assessment and contract controls.
Exposure insight on suppliers adds an outside-in view between assessments.
- 01
Third-party inventory and tiering
- 02
Risk-based assessment questionnaires
- 03
Contractual security requirements
- 04
Ongoing supplier monitoring
In Depth
How the Discipline Works
Start with an Honest Inventory
Third-party risk starts with a list most organizations do not have. Procurement records show who gets paid. They rarely show who holds data, who has an administrative account, or whose software runs inside the network. A useful inventory joins finance, IT, security and business-owner sources. Each entry records the service provided, the data touched, the connection type, the internal owner and any subcontractors the supplier relies on. Fourth parties matter because a supplier's hosting provider or code library can fail you just as directly. Without an accountable owner for every entry, the inventory decays within months and the program loses its factual base.
Tiering Decides How Much Scrutiny
Tiering decides how much scrutiny each supplier deserves. Two questions carry most of the weight: how badly would the business suffer if this supplier failed, and how much access does it hold to systems and data? A payroll processor with customer records and a cleaning contractor with a badge sit in very different places. Define tier criteria in writing, score suppliers against them, and record the rationale so a regulator or auditor can follow it. Reassess tiers when scope changes, such as a new integration, a new data category or an expanded administrator role. Tier assignments that never move suggest the criteria are ignored.
Evidence, Findings and Exit Planning
Assessment evidence should match the tier. Critical suppliers warrant a questionnaire plus proof: independent audit reports, penetration test summaries, policy documents and a review of how they manage privileged access to your environment. Lower tiers may need only a short attestation. Findings become tracked actions with owners and dates, and unresolved high-risk gaps feed the risk register rather than a filing cabinet. Between assessments, conditions change: a supplier is breached, certificates lapse, ownership shifts, or exposed services appear on the internet. Oversight therefore combines scheduled reviews, event triggers and exit planning, so the organization knows how it would leave a supplier that cannot meet its obligations.
A supplier you cannot name, with access you cannot see, is a breach waiting for a trigger.
Capability Matrix
What the Service Includes
| Capability | Coverage | GUIDE | SECURE | OPERATE | Delivered Through |
|---|---|---|---|---|---|
| Supplier Tiering | Criticality and access-based classification. | GUIDE stage | – | – | Advisory Engagements, Managed Security Services |
| Due Diligence Assessments | Proportionate reviews by tier. | GUIDE stage | – | – | Advisory Engagements, Managed Security Services |
| Contract Controls | Security clauses and right-to-audit terms. | GUIDE stage | – | – | Advisory Engagements, Managed Security Services |
| Third‑Party Exposure Insight | Outside-in exposure view of suppliers. | GUIDE stage | – | – | Advisory Engagements, Managed Security Services |
| Third‑Party ExposureAI-Assisted Operations | Exposure insight on suppliers | GUIDE stage | – | – | Advisory Engagements, Managed Security Services |
Supplier Tiering
Criticality and access-based classification.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Managed Security Services
Due Diligence Assessments
Proportionate reviews by tier.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Managed Security Services
Contract Controls
Security clauses and right-to-audit terms.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Managed Security Services
Third‑Party Exposure Insight
Outside-in exposure view of suppliers.
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Managed Security Services
Third‑Party Exposure
Exposure insight on suppliers
- Stage
- GUIDE
- Delivered Through
- Advisory Engagements, Managed Security Services
How It Works
How Third‑Party Risk Management Works
- 01Inventory
- 02Tier
- 03Assess
- 04Monitor
Methodology
The Method, Step by Step
- 1
Define Scope and Criteria
Agree what counts as a third party, which business services matter most, and how risk will be scored. Set tier thresholds for criticality, data sensitivity and access level. Align the criteria with the organization's risk appetite and regulatory duties so later decisions are consistent and can be explained to auditors.
- 2
Build the Inventory
Collect supplier data from procurement, accounts payable, identity systems, firewall rules and business owners. Reconcile duplicates, name an internal owner for each supplier, and record data types, connection paths and known subcontractors. Flag suppliers with standing privileged access first, since those connections carry the highest potential for lateral movement.
- 3
Score and Tier
Rate each supplier against the agreed criteria and place it in a tier. Document the reasoning, including who approved exceptions. Each tier maps to a defined assessment depth, contract baseline and review frequency, so effort follows exposure instead of whoever happens to ask the loudest question.
- 4
Assess and Remediate
Send tier-appropriate questionnaires and request evidence for critical suppliers. Validate answers against audit reports and observable external posture. Convert gaps into remediation actions with deadlines, agree compensating controls where fixes are slow, and escalate unresolved high-risk findings to the risk owner for an explicit accept, mitigate or exit decision.
- 5
Monitor and Offboard
Track supplier changes, incidents and renewals against the inventory. Revisit tiers when scope shifts. At contract end, revoke accounts, rotate shared secrets, retrieve or confirm destruction of data, and close network paths. Offboarding is where forgotten access can survive, so treat it as a controlled step with sign-off.
Operating Model
Delivered from the GUIDE Pillar
Pillar position
GUIDE
Advisory, Risk & Assurance
Engagement model
Advisory Engagements
Fixed-scope assessments, strategy, compliance and testing.
Best for · Defined questions with a clear deliverable
Engagement model
Managed Security Services
SOC, MXDR and managed cloud security under SLAs.
Best for · 24/7 coverage without building in-house
Threat Scenarios
What It Looks Like in Practice
Compromised Managed Service Provider
How It Shows Up
Administrative logins from an MSP tool occur at odd hours or touch systems outside the contracted scope.
Response
Named supplier identities, session logging and segmentation limit reach, and the inventory shows which accounts to revoke.
Malicious Software Update
How It Shows Up
A signed update from a trusted vendor triggers unusual outbound connections or new processes across many hosts.
Response
Mapping products to hosts identifies affected systems, and staged rollout limits spread while the update's integrity is verified.
Supplier Breach of Your Data
How It Shows Up
A vendor reports an incident, or your data surfaces externally, and no record shows what that vendor held.
Response
The inventory lists data types and contacts, so you can scope impact and meet notification duties such as the GDPR 72-hour expectation where it applies.
Fourth‑Party Failure
How It Shows Up
A breach or outage at a supplier's hosting or software provider disrupts your service, though you have no contract with that provider.
Response
Subcontractor disclosure and flow-down clauses reveal the dependency in advance, and tested exit and continuity plans shorten recovery.
| Scenario | How It Shows Up | Response |
|---|---|---|
| Compromised Managed Service Provider | Administrative logins from an MSP tool occur at odd hours or touch systems outside the contracted scope. | Named supplier identities, session logging and segmentation limit reach, and the inventory shows which accounts to revoke. |
| Malicious Software Update | A signed update from a trusted vendor triggers unusual outbound connections or new processes across many hosts. | Mapping products to hosts identifies affected systems, and staged rollout limits spread while the update's integrity is verified. |
| Supplier Breach of Your Data | A vendor reports an incident, or your data surfaces externally, and no record shows what that vendor held. | The inventory lists data types and contacts, so you can scope impact and meet notification duties such as the GDPR 72-hour expectation where it applies. |
| Fourth‑Party Failure | A breach or outage at a supplier's hosting or software provider disrupts your service, though you have no contract with that provider. | Subcontractor disclosure and flow-down clauses reveal the dependency in advance, and tested exit and continuity plans shorten recovery. |
Outcomes
What Your Institution Gains
- Visibility of supplier risk
- Fewer unmanaged privileged connections
- Defensible vendor decisions
Deliverables and Roles
What You Receive, and Who Does What
| Deliverable | Purpose |
|---|---|
| Third‑Party Inventory Register | Gives one authoritative record of suppliers, owners, data types and access paths. |
| Tiering Methodology | Documents criteria and thresholds so classification is repeatable and explainable. |
| Supplier Risk Reports | Summarize findings, evidence reviewed and remediation actions for each assessed supplier. |
| Contract Security Requirements Schedule | Supplies clauses and standards that procurement and counsel can attach to agreements. |
| Oversight Calendar and Exit Checklist | Sets review triggers and the steps for orderly supplier offboarding. |
| Role | Responsibility |
|---|---|
| Business Relationship Owner (Client) | Owns the supplier relationship and confirms what access the service genuinely needs. |
| Procurement Lead (Client) | Embeds security requirements and tier checks into sourcing and renewal workflows. |
| Risk or Security Executive (Client) | Sets tiering criteria, approves exceptions and decides on residual supplier risk. |
| Third‑Party Risk Assessor (Provider) | Validates supplier evidence and reports findings with clear ratings and actions. |
Maturity Model
Where Organizations Typically Stand
Stage 1
Ad Hoc
Supplier knowledge sits with individuals and procurement files. Reviews happen after an incident or a customer demand.
Stage 2
Defined
An inventory and tiers exist, supported by a standard questionnaire and baseline contract language.
Stage 3
Managed
Assessments follow tiers, findings are tracked to closure, and a named owner is accountable for each supplier.
Stage 4
Optimized
External signals and event triggers update supplier risk between reviews, and results shape sourcing and exit decisions.
Frameworks and Regulation
The Standards That Shape This Work
ISO/IEC 27001:2022
Annex A includes controls on supplier relationships within its organizational theme. ISO/IEC 27002:2022 gives guidance on applying them.
NIST CSF 2.0
The Govern function covers cybersecurity supply chain risk management, while Identify supports the supplier inventory.
Bank of Ghana Cyber and Information Security Directive
Regulated financial institutions in Ghana that rely on outsourced providers should confirm the specific supplier-related provisions with their compliance teams.
Ghana Data Protection Act, 2012 (Act 843)
The data security safeguards principle still applies when a supplier processes personal data, so controllers should assess those suppliers.
Buyer Guidance
Choosing the Right Provider
What to look for
- Look for a method that tiers suppliers by both criticality and access, not by spend alone.
- Expect validation of evidence, not only questionnaires that suppliers grade themselves.
- Findings should end in owned remediation actions and a documented risk decision.
- Contract requirements should be practical for procurement and reviewed by your own legal counsel.
Questions to ask a provider
- How do you find suppliers that are missing from procurement records?
- What evidence do you request from critical suppliers beyond a questionnaire?
- How do you treat fourth parties and subcontractors?
- What happens when a supplier refuses to fix a high-risk finding?
Regulatory & Industry Context
The Obligations This Service Supports
Supply-chain controls draw on ISO/IEC 27001, NIST CSF and regulator outsourcing expectations in financial services.
Frameworks DAAKYI helps clients implement
- ISO/IEC 27001
- NIST CSF
- SOC 2
Framework references describe client implementation support, not DAAKYI certifications.
Technical Detail
For Architects and Security Leads
Framework and regulatory alignment
- ISO/IEC 27001
- NIST CSF
- SOC 2
Supply-chain controls draw on ISO/IEC 27001, NIST CSF and regulator outsourcing expectations in financial services.
Architecture reference
How Third-Party Risk Management Works: Inventory → Tier → Assess → Monitor.
DAAKYI inventories third parties, tiers them by criticality and access, and applies proportionate assessment and contract controls.
Privileged Access Paths into Your Environment
Supplier access usually arrives through a handful of patterns: site-to-site VPNs, remote support tools, shared administrator accounts, API keys and federated identities. Each deserves a review. Shared accounts defeat attribution, so replace them with named identities. Enforce multifactor authentication, time-bound access and session recording for administrative work. Segment supplier connections so a compromised partner network reaches only the systems in scope, consistent with the least-privilege thinking in NIST SP 800-207 on Zero Trust Architecture. Log supplier activity into the same monitoring pipeline as internal users, and map suspicious behavior such as valid-account abuse to MITRE ATT&CK tactics so detections cover the supply-chain route. Review dormant supplier accounts on a fixed schedule.
Software Supply-Chain and Update Integrity
Not every supplier connects through a network. Software vendors reach you through updates, plug-ins and open-source dependencies. Request a software bill of materials where the supplier can provide one, and track known vulnerabilities in listed components. Verify code signing on installers and updates, and stage updates in a test ring before broad deployment. For custom software, ask whether the supplier follows secure development practice and tests against the OWASP Top 10 and OWASP ASVS. Add contractual duties for timely vulnerability disclosure and patch delivery. Finally, plan for the case where a trusted update is malicious: know which hosts run the product, and be able to isolate them quickly.
Glossary
Key Terms
- Fourth Party
- A supplier's own supplier or subcontractor that touches your data or service.
- Concentration Risk
- Exposure created when many critical services depend on a single supplier or shared provider.
- Right to Audit
- A contract term that lets the customer inspect a supplier's security controls.
- Software Bill of Materials
- A list of the components and dependencies inside a software product.
Related
Explore Connected Capabilities
Proof Points
What We Can Stand Behind
- Every stage of DAAKYI's delivery methodology produces documented, auditable deliverables.
FAQ
Questions Leaders Ask
DAAKYI Intelligence
Ask Kasara About Third‑Party Risk Management
Kasara, our AI assistant, answers from DAAKYI's published content and can connect you with a specialist.
Next Step
Discuss Third‑Party Risk Management with DAAKYI
Tell us about your environment and obligations. A DAAKYI specialist for Third-Party Risk Management will respond.
Talk to a Cybersecurity Expert