Third-party risk, in practice
Practical guidance on vendor risk, continuous monitoring, nth-party risk and the regulations behind them, from the team that builds VendRisk360.
Follow with RSSContinuous monitoring
7 min read
PHP2Shell (CVE-2026-109618, CVE-2026-109619): what to do now
PHP2Shell is two critical PHP flaws that can let an unauthenticated attacker run code on a web server. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then check your vendors.
Most recent posts
DORA register of information: what goes in it
The DORA register of information records every ICT third-party contract, the functions it supports and the subcontractors behind critical ones. Here is what it holds, who reports it and how to gather the data.
Vendor data breach: what to do in the first 72 hours
When a vendor is breached, confirm it affects you, contact the vendor, check contract notice clauses and your own notification duties, look for fourth-party exposure, and record every decision.
How often should you reassess vendors? Cadence by tier
There is no single right reassessment cadence. Set it per tier in your own policy, anchor the clock on current evidence, and let events such as a breach or an ownership change bring a review forward.
Vendor risk assessment checklist: evidence by tier
A vendor risk assessment checklist starts with scoping and tiering, then asks for evidence matched to each tier, reviews it for scope, dates and exceptions, tracks findings and records sign-off.
Interagency third-party guidance (OCC 2023-17), explained
The 2023 interagency guidance tells US banks to manage third parties across five life-cycle stages, with stronger oversight for critical activities. Here is what it asks, what examiners check and what is changing.
Vendor concentration risk: when many vendors share one provider
Vendor concentration risk is dependence on one provider, place or technology for many critical services. Measure it across the portfolio, test the blast radius, and plan exits and alternatives.
Third-party risk management
Building and running a third-party risk program.
Vendor risk assessment
Due diligence, evidence, SOC reports and findings.
Continuous monitoring
Attack surface, breaches and financial distress between reviews.
Nth-party and concentration risk
Fourth parties, shared providers and the blast radius.
Regulations and compliance
What regulators expect, region by region.
See VendRisk360 on your own vendors
A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.