Third-Party Risk Management (TPRM)

Third-Party Risk Management, or TPRM, is the process of identifying, assessing, monitoring, and managing risks created by vendors, suppliers, partners, and other external organizations.

Third parties may process sensitive data, connect to internal systems, provide critical services, or introduce additional subcontractors and technologies into the organization.

A TPRM program may include vendor inventories, due diligence, questionnaires, security and privacy assessments, contractual controls, continuous monitoring, and remediation.

As vendors increasingly add AI capabilities to their products, third-party risk management is also becoming an important part of AI governance.