# First and third parties

> How companies decide what to do themselves and what to hand to other businesses, and how to choose, contract, secure, manage and leave those outside partners.

Source: https://docs.lumina-erp.com/first-and-third-parties/

**In short.** Every business runs on other businesses. This section is a vendor-neutral field guide to that dependence: what to keep first party, what to buy or outsource, how to choose and contract a third party, how to manage the risk and how to leave cleanly.

No company does everything itself. A distributor buys its products from manufacturers, moves them with carriers, runs its books on software someone else wrote, takes card payments through a processor, calculates tax with an outside engine and calls a partner when the ERP misbehaves. Each of those relationships saves time or money, and each one moves part of your business into someone else's hands.

We wrote this section for owners and project leads. It starts with what first party and third party mean and how to decide between doing something yourself, buying it or hiring it done. It then covers choosing and contracting a vendor, security and risk, running the relationship once it is live and leaving without losing your data or your customers. It is vendor neutral and names categories and public standards, never products.

The table points common questions to the page that answers them.

| If you are asking | Start with |
|---|---|
| What counts as first party, third party or fourth party? | [First party and third party, explained](/first-and-third-parties/first-party-and-third-party-explained/) |
| Should we build it, buy it or hire someone? | [Build, buy or partner](/first-and-third-parties/build-buy-or-partner/) |
| Which outside businesses does a distributor depend on? | [The third-party landscape for distributors](/first-and-third-parties/the-third-party-landscape-for-distributors/) |
| How do we pick between vendors? | [Choosing a vendor](/first-and-third-parties/choosing-a-vendor/) |
| What should we look for in the contract? | [Contracts, SLAs and data rights](/first-and-third-parties/contracts-slas-and-data-rights/) |
| How much vendor risk process do we need? | [Third-party risk management](/first-and-third-parties/third-party-risk-management/) |
| How do we get out of a vendor relationship? | [Leaving a vendor](/first-and-third-parties/leaving-a-vendor/) |

:::note[We are a third party too]
Lumina ERP is a consultancy, which makes us one of the outside businesses these pages teach you to evaluate. We have tried to write the advice we would give if we had nothing to sell, including how to judge and leave firms like ours.
:::

## Every page in this section

- [First party and third party, explained](https://docs.lumina-erp.com/first-and-third-parties/first-party-and-third-party-explained.md): What first, third and fourth party mean for suppliers, software, data, support and cloud, and why the label decides who is accountable when something breaks.
- [Build, buy or partner](https://docs.lumina-erp.com/first-and-third-parties/build-buy-or-partner.md): Decide whether to do a job yourself, buy a product or hire a service, using core versus context, five-year total cost of ownership and a weighted matrix.
- [The third-party landscape for distributors](https://docs.lumina-erp.com/first-and-third-parties/the-third-party-landscape-for-distributors.md): Map of the outside businesses a wholesale distributor relies on, what data each touches, what breaks when it fails, typical contracts and what to ask.
- [Lessons from other industries](https://docs.lumina-erp.com/first-and-third-parties/lessons-from-other-industries.md): How banking, healthcare, automotive, retail, cloud, government, defense, food and pharma manage third parties, and which practices a distributor can borrow.
- [Choosing a vendor](https://docs.lumina-erp.com/first-and-third-parties/choosing-a-vendor.md): A step-by-step vendor selection process, from must-haves and a long list through RFPs, scripted demos, reference calls, pilots, scoring and negotiation.
- [Contracts, SLAs and data rights](https://docs.lumina-erp.com/first-and-third-parties/contracts-slas-and-data-rights.md): What each vendor contract document covers, the clauses that decide cost, risk and your exit, why service credits are small and which terms to negotiate first.
- [Managing vendors after go-live](https://docs.lumina-erp.com/first-and-third-parties/managing-vendors-after-go-live.md): How to run vendors after the contract is signed, with named owners, a vendor register, tiering, business reviews, KPIs, a renewal calendar and invoice audits.
- [Leaving a vendor](https://docs.lumina-erp.com/first-and-third-parties/leaving-a-vendor.md): How to exit a vendor cleanly, from planning at signature through notice, data extraction, parallel running, revoking access and data destruction.
- [Third-party risk management for mid-sized companies](https://docs.lumina-erp.com/first-and-third-parties/third-party-risk-management.md): How to run third-party risk management at a 50 to 500 person distributor, scaling the bank regulators' lifecycle and NIST CSF 2.0 to what you can sustain.
- [Security and data sharing with vendors](https://docs.lumina-erp.com/first-and-third-parties/security-and-data-sharing-with-vendors.md): How to judge a vendor's security evidence (SOC reports, ISO 27001, questionnaires) and control what you share, from vendor access and API keys to breaches.
- [Fourth parties and concentration risk](https://docs.lumina-erp.com/first-and-third-parties/fourth-parties-and-concentration-risk.md): How your vendors' vendors and shared dependencies can stop your business, with public incidents, a dependency mapping method and a tabletop exercise outline.
- [Vendor due diligence checklist](https://docs.lumina-erp.com/first-and-third-parties/vendor-due-diligence-checklist.md): A due diligence checklist for choosing a vendor, grouped from financial health and security to insurance, exit rights and pricing, and scaled by tier.
- [ERP add-ons and independent software vendors](https://docs.lumina-erp.com/first-and-third-parties/erp-add-ons-and-isvs.md): When to use a native ERP feature, a third-party add-on, a custom extension or a connected system, what to check before buying and how to handle upgrades.
- [Choosing and working with implementation partners and consultants](https://docs.lumina-erp.com/first-and-third-parties/implementation-partners-and-consultants.md): How to pick the right kind of ERP partner or consultant, choose a pricing model, write a statement of work and finish the work owning your system.
- [Logistics providers, 3PLs and carriers](https://docs.lumina-erp.com/first-and-third-parties/logistics-providers-and-3pls.md): How in-house logistics compares with 3PLs and 4PLs, what carriers, brokers and forwarders do, how 3PLs price and where integration and liability gaps sit.
- [Outsourced business services](https://docs.lumina-erp.com/first-and-third-parties/outsourced-business-services.md): What distributors commonly outsource, from accounting and payroll to IT, hosting, collections and staffing, and what must stay in house for each service.
- [Selling through others, and being someone else's third party](https://docs.lumina-erp.com/first-and-third-parties/selling-through-others.md): How distributors sell through reps, buying groups, marketplaces, drop ship and punchout, handle chargebacks and prepare for customer vendor risk reviews.

---

Epicor, Prophet 21, P21 and DynaChange are trademarks or registered trademarks of Epicor Software Corporation registered in the United States and other countries. Kinetic is a trademark of Epicor Software Corporation. Lumina ERP is an independent consultancy and is not affiliated with, sponsored by or endorsed by Epicor.