Glossary
Third-party risk terms, defined
The 38 words risk, security, procurement and audit teams use, in plain language. New to the subject? Start with the third-party risk management guide.
38 terms
- Attack surface
- Everything a third party exposes to the internet that an attacker could probe.
- Learn more: Attack surface monitoring
- Blast radius
- Everything affected when one provider fails: the vendors, services and business processes that depend on it.
- Learn more: Nth-party intelligence
- Bridge letter
- A statement from a service organization covering the gap between the end of its last SOC report period and today.
- Concentration risk
- The risk of depending on one provider, service or region for many critical services at once.
- Learn more: Nth-party intelligence
- Continuous monitoring
- Watching third parties for changes in risk between scheduled assessments.
- Learn more: Continuous monitoring
- Critical or important function
- A business function whose disruption would materially affect an organization; regulators expect closer oversight of third parties that support one.
- Learn more: Regulatory coverage
- Criticality
- How important a third party is to your business: what would happen if it stopped delivering.
- CUEC
- Complementary user entity controls: controls a SOC report assumes the customer operates. If you do not, the auditor’s conclusion may not hold for you.
- Learn more: Nth-party intelligence
- Data breach
- Unauthorized access to or disclosure of data. A vendor’s breach can trigger your own notification decisions.
- Learn more: Data breach alerts
- Due diligence
- The review of a third party before and during the relationship: questionnaires, evidence and checks.
- Learn more: Vendor risk assessment
- Exit strategy
- A plan to leave a third-party relationship, or replace the provider, without disrupting the service.
- Learn more: Vendor lifecycle
- Financial distress
- Signs that a company may not be able to keep trading: bankruptcy, insolvency, receivership or liquidation.
- Learn more: Financial distress alerts
- Finding
- A gap found in a vendor’s controls or evidence, raised with the vendor and tracked to closure.
- Fourth party
- A third party’s own vendor or subcontractor, such as the cloud platform a vendor runs on.
- Learn more: Nth-party intelligence
- Indicator of compromise
- A sign that a system may already be compromised, such as a host listed as malware infrastructure.
- Learn more: Data breach alerts
- Inherent risk
- The risk a relationship carries before any controls are considered: the vendor’s tier (criticality) combined with its exposure (the data, access and regulatory scope it brings).
- Material service provider
- Under APRA CPS 230, a provider an entity relies on for a critical operation or that exposes it to material risk.
- Learn more: Regulatory coverage
- Nth party
- Any party further down the chain: your vendors’ vendors and their providers in turn.
- Learn more: Nth-party intelligence
- Offboarding
- Ending a relationship safely: removing access, returning or destroying data and recording the exit.
- Learn more: Vendor lifecycle
- Penetration test
- An authorized, simulated attack on a system by testers, reported with the weaknesses found. A common piece of vendor evidence.
- Reassessment
- A repeat review of a vendor on the cadence its tier sets, or sooner when something changes.
- Learn more: Vendor risk assessment
- Register of information
- Under DORA, the record of an EU financial entity’s ICT third-party arrangements and the subcontractors behind them.
- Learn more: Regulatory coverage
- Remediation
- The vendor’s fix for a finding, with an owner and a target date.
- Residual risk
- The risk that remains after the third party’s controls are assessed and any findings are treated.
- Risk acceptance
- An approved, time-bound decision to live with a risk, with an owner and conditions, instead of fixing it now.
- Sanctions screening
- Checking a third party against government sanctions and exclusion lists, at onboarding and on an ongoing basis.
- Security questionnaire
- A structured set of questions a vendor answers about its controls, usually backed by evidence.
- Learn more: Vendor risk assessment
- Security rating
- An outside-in score of an organization’s internet-facing security, built from what anyone can observe.
- Learn more: Attack surface monitoring
- Shadow infrastructure
- Internet-facing hosts and subdomains linked to a vendor that are easy to forget, such as old sites and staging servers.
- Learn more: Attack surface monitoring
- SIG and CAIQ
- Widely used industry questionnaires: the Standardized Information Gathering questionnaire and the Consensus Assessments Initiative Questionnaire for cloud providers.
- Sign-off
- The recorded approval of an assessment’s outcome by the people accountable for it.
- SOC 1 and SOC 2 reports
- Independent auditor reports on a service organization’s controls: SOC 1 for financial reporting, SOC 2 for security, availability, processing integrity, confidentiality and privacy.
- Learn more: SOC report and program reviews
- Subservice organization
- A provider a service organization relies on, named in its SOC report and often carved out of its scope.
- Supplier
- A third party you buy goods or services from; the procurement term for a vendor.
- Learn more: Supplier risk management
- Third party
- Any outside organization you rely on: vendors, suppliers, service providers, partners and affiliates.
- Third-party risk management (TPRM)
- Identifying, assessing, monitoring and reducing the risks that come from third parties, across the whole relationship.
- Tier
- A criticality band, from Tier 1 Critical to Tier 4 Low, that sets how much oversight a third party gets: evidence, assessment depth, monitoring and reassessment cadence.
- Learn more: Vendor lifecycle
- Vendor
- A third party that provides technology or services. Used interchangeably with supplier in many organizations.
Get started
See VendRisk360 on your own vendors
A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.