Fourth-Party Risk Management
Understanding and managing risks from your vendors' vendors - the extended supply chain.
Fourth-Party Risk Management
What is Fourth-Party Risk?
Fourth parties are the vendors, suppliers, and service providers used by your direct third parties. They represent an extended risk that is often less visible but equally impactful.
Why Fourth-Party Risk Matters
- Your third party's breach is your breach
- Regulatory expectations extend to subcontractors
- Concentration risk across supply chains
- Limited visibility and control
Identifying Fourth Parties
Key Questions for Third Parties:
- What subcontractors do you use?
- Where is data stored and processed?
- Who has access to our data?
- What security requirements do you impose?
- How do you monitor subcontractor performance?
Mapping Techniques:
- Contract review (subcontracting provisions)
- Third-party questionnaires
- Network analysis tools
- Industry databases
Managing Fourth-Party Risk
Contractual Controls
- Subcontracting approval rights
- Flow-down of security requirements
- Audit rights extending to subcontractors
- Notification of material subcontracting changes
Due Diligence
- Request third-party TPRM program details
- Review subcontractor assessment results
- Understand concentration exposures
- Assess geographic distribution
Monitoring
- Track critical fourth-party relationships
- Monitor for adverse news
- Include in scenario testing
- Regular updates from third parties
Concentration Risk
- Identify shared fourth parties across your third-party portfolio
- Map dependencies on common infrastructure (cloud providers)
- Develop contingency plans for critical concentrations
Regulatory Expectations
Regulators increasingly expect organizations to:
- Know critical fourth parties
- Assess concentration risk
- Include in resilience testing
- Have exit strategies