TPM-03: Annual Third-Party Risk Assessment

Control Description

On an annual basis, management evaluates the third parties that have access to confidential data and/or that perform a managed service related to the operation of the System and determines their risk-rating based on their level of access, the sensitivity of the related data, and the impact to operations. Based on this risk rating, management either performs a vendor security assessment of the third party, reviews the third party's System and Organization Control reports such as SOC 2 reports, or the third party is subjected to continuous monitoring controls.

Plain Meaning

This control requires organizations to annually assess the risk posed by third parties who have access to confidential data or provide managed services. Based on the risk level, organizations must either conduct security assessments, review SOC 2 reports, or implement continuous monitoring.

Implementation

Risk Assessment Process

Assessment Criteria

• Level of Access: What systems and data the third party can access
• Data Sensitivity: How sensitive the data accessed by the third party is
• Operational Impact: How critical the third party's services are to operations
• Security Posture: Current security practices and compliance status
• Incident History: Past security incidents or compliance issues

Risk Rating Framework

• High Risk: Access to highly sensitive data or critical operational services
• Medium Risk: Access to moderately sensitive data or important services
• Low Risk: Limited access to non-sensitive data or non-critical services

Implementation Approach

Annual Assessment Process

• Third-Party Inventory: Maintain complete list of all third parties
• Risk Evaluation: Annual evaluation of each third party's risk level
• Assessment Planning: Plan appropriate assessment based on risk rating
• Documentation: Document all assessment activities and findings
• Follow-up Actions: Implement required actions based on assessment results

Assessment Options by Risk Level

• High Risk: Full vendor security assessment or SOC 2 report review
• Medium Risk: SOC 2 report review or targeted security assessment
• Low Risk: Continuous monitoring or periodic compliance checks

Simple Implementation Steps

1. Inventory Third Parties: Document all third parties with data access or managed services
2. Define Risk Criteria: Establish clear criteria for risk assessment
3. Conduct Annual Assessment: Evaluate each third party annually
4. Assign Risk Ratings: Categorize third parties by risk level
5. Plan Assessments: Determine appropriate assessment method for each risk level
6. Execute Assessments: Conduct planned assessments and reviews
7. Document Results: Record all assessment activities and findings

Assessment Methods

• Vendor Security Assessment: On-site or remote security evaluation
• SOC 2 Report Review: Review of third party's SOC 2 reports
• Continuous Monitoring: Ongoing monitoring of third party security
• Compliance Verification: Verification of compliance with security requirements

Key Success Factors

1. Annual Schedule: Consistent annual assessment process
2. Comprehensive Coverage: Assessment of all relevant third parties
3. Risk-Based Approach: Appropriate assessment method for each risk level
4. Documentation: Complete records of all assessment activities
5. Follow-up Actions: Implementation of required actions based on assessments

Common Pitfalls to Avoid

• Irregular Assessments: Not conducting assessments annually
• Incomplete Coverage: Missing some third parties in assessment
• Inappropriate Methods: Using wrong assessment method for risk level
• No Follow-up: Not implementing required actions based on assessments

Related Controls

• TPM-01: Third-party communication protocols
• TPM-02: Vendor compliance remediation
• TPM-04: Standard vendor agreements

Related Links

Third-Party Risk Management

• Third-Party Risk Assessment
• Vendor Security Evaluation
• SOC 2 Report Review