Third-Party Risk Assessment
That Looks Beyond
Vendor Questionnaires
Third-party risk assessment
Understand and Reduce the Cyber Risk Your Vendors Bring In
Suppliers, service providers and SaaS platforms often hold your data or connect to your systems. iSpyCyber assesses them with risk-based tiering, structured due diligence, independent evidence review and continuous monitoring, so you know which third parties create real exposure and what to do about it.
Why organisations choose iSpyCyber
Risk-based tiering
Assessment depth matches each vendor's access, data and criticality, so effort goes where exposure is greatest.
Evidence, not just answers
Questionnaire responses are verified against certifications, audit reports, contracts and policies.
Outside-in view
Our offensive security team reviews each vendor's external attack surface to spot issues questionnaires miss.
Contract-aware
Security, audit, breach notification and data protection clauses reviewed against your requirements.
Vendor-friendly process
Clear requests and direct follow-up reduce friction and speed up responses from your suppliers.
Continuous monitoring
Ongoing tracking of vendor exposure between assessments, supported by iefyx, our AI-native threat exposure platform.
Coverage
What We Assess in Your Third Parties
Each assessment is scaled to the vendor’s tier and covers the controls that protect your data, systems and services.
Security governance
Policies, security leadership, risk management and certifications such as ISO/IEC 27001 or SOC 2.
Data protection
Data handling, encryption, retention, cross-border transfers and DPDP Act 2023 obligations.
Access to your environment
Remote access, privileged accounts, MFA and how vendor staff reach your systems and data.
Infrastructure and cloud
Hosting, secure configuration, segmentation and cloud shared-responsibility controls.
Secure development
SDLC practices, code review, vulnerability management and penetration testing for software vendors.
Incident response
Detection, incident handling, breach notification timelines and cooperation commitments.
Business continuity
Resilience, backup, disaster recovery and dependency on the vendor's own suppliers.
Fourth-party risk
Sub-processors and critical downstream providers that support the vendor's service.
External attack surface
Exposed services, leaked credentials, misconfigurations and publicly reported incidents.
Methodology
A Proven Six-Phase Third-Party Risk Methodology
Aligned to ISO/IEC 27036, NIST SP 800-161 and NIST CSF 2.0 supply chain guidance, and tailored to your vendor portfolio and regulators.
- ISO/IEC 27036
- NIST SP 800-161
- NIST CSF 2.0
- ISO/IEC 27001
- SIG questionnaire
4–8
weeks for an initial portfolio cycle
6
structured lifecycle phases
100%
critical vendors evidence-reviewed
01
- Weeks 1–2
Inventory and scope
Your third parties, services and data flows identified to define which vendors need assessment.
Key activities
- Consolidate vendor lists from procurement and finance
- Map services, data access and system connectivity
- Agree assessment criteria and risk appetite
- Output: Third-party inventory
02
- Week 2
Tier and prioritise
Each vendor tiered by inherent risk so assessment depth matches the exposure it creates.
Key activities
- Score data sensitivity, access and criticality
- Assign risk tiers and assessment depth
- Agree assessment calendar per tier
- Output: Risk-tiered vendor register
03
- Weeks 2–4
Due diligence questionnaires
Tier-appropriate questionnaires issued, tracked and followed up with each third party.
Key activities
- Issue SIG-style or custom questionnaires
- Track responses and chase outstanding items
- Clarify answers directly with vendor contacts
- Output: Completed questionnaires
04
- Weeks 3–6
Evidence review
Vendor answers verified against certifications, reports, policies and external security signals.
Key activities
- Review ISO certificates, SOC reports and policies
- Assess contracts for security and audit clauses
- Check external attack surface and breach history
- Output: Validated vendor findings
05
- Weeks 5–7
Rate and remediate
Residual risk rated for each vendor, with remediation actions agreed and risk decisions documented.
Key activities
- Rate residual risk per vendor
- Agree remediation plans with third parties
- Document risk acceptance decisions
- Output: Vendor risk reports
06
- Ongoing
Monitor continuously
Ongoing monitoring and periodic reassessment keep vendor risk current between reviews.
Key activities
- Monitor external exposure and security signals
- Reassess on renewal, incidents or scope change
- Report portfolio risk to leadership
- Output: Portfolio risk dashboard
Effort distribution
Where the assessment time goes
Most of the effort goes into collecting and verifying vendor evidence, not simply sending questionnaires. Percentages are indicative for an initial portfolio assessment.
Quality built into every phase
Answers verified
Critical claims are checked against documentary evidence.
Consistent ratings
One risk model applied across your entire vendor portfolio.
Outside-in checks
External exposure reviewed for higher-tier vendors.
Decisions recorded
Remediation and risk acceptance documented for audit.
Engagement options
Choose the Third-Party Risk Model That Fits
Every option uses the same tiering and rating model, so you can start small and scale into a managed programme.
Critical vendor assessment
Deep due diligence on a defined set of high-risk or new vendors. Best for onboarding decisions, renewals and regulator requests.
Programme design and portfolio review
Tiering model, questionnaires, policy and a first assessment cycle across your vendor base. Best for building or maturing a TPRM function.
Managed third-party risk
Ongoing assessments, monitoring and reporting run by iSpyCyber on your behalf. Best for lean teams and large vendor portfolios.
Not sure which option you need?
Our specialists will recommend an approach based on your vendor portfolio, data flows and regulators.
Deliverables
Outputs for Risk, Procurement and Auditors
Clear vendor decisions for leadership, practical actions for procurement and a defensible record for auditors and regulators.
Portfolio risk summary
Vendor risk distribution, top exposures and trends for leadership and risk committees.
Vendor risk reports
Per-vendor tier, findings, evidence reviewed, residual risk rating and recommendations.
Remediation tracker
Agreed vendor actions with owners and dates, plus documented risk acceptance decisions.
TPRM programme toolkit
Tiering model, questionnaires, contract clauses and procedures your team can reuse.
Supports your compliance and assurance requirements
- ISO/IEC 27001
- ISO/IEC 27036
- NIST SP 800-161
- NIST CSF 2.0
- SOC 2
- DPDP Act 2023
- RBI outsourcing directions
- SEBI CSCRF
- IRDAI guidelines
- GDPR
- DORA
iSpyCyber provides independent assessment, internal audit and readiness support against these requirements. iSpyCyber does not issue certifications; certification, attestation and statutory audit opinions are issued by accredited bodies and licensed or regulator-recognised auditors.
Third-party risk assessments for every industry
FAQ
Third-party risk assessment questions, answered
Can’t find what you need? Talk to our security team.
The basics
What is a third-party risk assessment?
A third-party risk assessment evaluates the security, privacy and resilience controls of a vendor, supplier or service provider that accesses your data or systems, and rates the residual risk that relationship creates for your organisation.
Do you only send questionnaires?
No. Questionnaires are one input. We verify answers against certifications, audit reports, policies and contracts, and review each higher-tier vendor’s external attack surface.
How do you decide which vendors to assess?
We tier vendors by the data they handle, their access to your environment and the criticality of their service. Assessment depth and frequency follow the tier.
Does this help with regulatory requirements?
Yes. Regulators such as RBI, SEBI and IRDAI expect regulated entities to manage outsourcing and vendor risk. Our assessments and records support those obligations and related audits.
Working with us
How long does it take?
A single critical vendor assessment usually takes two to three weeks, largely depending on vendor responsiveness. An initial portfolio cycle typically takes four to eight weeks.
What happens when a vendor has gaps?
We agree remediation actions and timelines with the vendor, track progress and document any risk acceptance decisions made by your management.
Can you run the programme for us?
Yes. Our managed third-party risk option covers ongoing assessments, monitoring and reporting, so your team can focus on decisions rather than administration.
Get started
Trust Your Vendors.
But Verify Them First.
Talk to our specialists about a third-party risk assessment scoped to your vendor portfolio.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries