# Third-party risk management for mid-sized companies

> How to run third-party risk management at a 50 to 500 person distributor, scaling the bank regulators' lifecycle and NIST CSF 2.0 to what you can sustain.

Source: https://docs.lumina-erp.com/first-and-third-parties/third-party-risk-management/

**In short.** Third-party risk management is the habit of knowing which outside businesses you depend on, how badly each one could hurt you and checking the important ones before you sign and while you use them. A mid-sized distributor does not need a bank's program: an inventory, three criticality tiers, a due diligence depth per tier and an annual review of the top tier cover most of the risk.

Third-party risk management (TPRM) means knowing which outside businesses you rely on, deciding how much each could hurt you if it failed and matching the effort you spend on each to that answer. For a mid-sized distributor the honest version is small: a list of vendors, three tiers, a due diligence depth per tier, a contract checklist and a yearly look at the handful that could stop you shipping. Below, we take the lifecycle the U.S. bank regulators published in 2023, cut it down to what a 50 to 500 person company can sustain and map it to the supply chain part of NIST CSF 2.0.

## At a glance

The table answers the common first questions.

| Question | Short answer |
|---|---|
| What is a third party? | Any outside business you have an ongoing arrangement with: software vendors, hosting, 3PLs, carriers, payment and tax services, consultants, reps, key suppliers |
| Why bother? | You can outsource the work but not the consequences. When a vendor fails, your customers see your name |
| What is the core tool? | An inventory with a criticality tier on every row |
| How much effort? | Heavy for tier 1 (a few vendors), light for tier 2, a form and a contract check for tier 3 |
| Who owns it? | One named person coordinates, and each vendor has a business owner who answers for it |
| Which frameworks help? | The 2023 interagency guidance for the lifecycle, NIST CSF 2.0 GV.SC for the security side, NIST SP 800-161 if you want depth |

## Where the lifecycle comes from

In June 2023 the Federal Reserve, the FDIC and the OCC replaced their separate vendor guidance with one document, the Interagency Guidance on Third-Party Relationships: Risk Management (Federal Register, June 9, 2023, retrieved 2026-09-28). It is written for banks, but it is the clearest public description of how to manage outside businesses. It says plainly that the effort should match the risk and complexity of each relationship. That principle is what makes it usable for a distributor.

The guidance describes a lifecycle with five stages, wrapped in governance.

| Stage | Guidance aim | At a distributor |
|---|---|---|
| Planning | Decide whether to use a third party at all, and understand the risks before you look at vendors | A one-page business case: why outside, what it touches, what happens if it fails, who owns it |
| Due diligence and selection | Check that the vendor can do the work safely and will still be around | Questionnaire, references, financial check, security evidence, depth set by tier |
| Contract negotiation | Put expectations, rights and remedies in writing | Service levels, data ownership, security duties, breach notice, audit rights, exit help |
| Ongoing monitoring | Keep checking performance and risk while the relationship runs | Quarterly scorecard for tier 1, annual review of evidence, watch for ownership changes |
| Termination | Leave in an orderly way, with your data and without a gap in service | Exit plan written at signing, data return and deletion confirmed, access removed |

The governance wrapper is three things: someone is accountable (oversight and accountability), someone independent occasionally checks that the process is followed (independent review) and you keep records good enough to show what you decided and why (documentation and reporting).

:::caution[Not legal or regulatory advice]
The interagency guidance applies to banking organizations. We use it here as a model, not as a rule you are subject to. If you are in a regulated industry, or a customer's contract imposes vendor oversight duties on you, involve counsel and your auditors in deciding what your program must include.
:::

## The risks you are managing

Most vendor problems fall into a handful of types. One vendor usually carries several at once, and the tier you give it should reflect the worst of them.

| Risk type | What it means | Example (invented) |
|---|---|---|
| Operational | The vendor cannot deliver the service as agreed | A 3PL mis-ships 4% of orders for three weeks during peak |
| Cyber and information security | The vendor, or its access into you, becomes the way an attacker or a leak reaches your data | A remote support tool account for an add-on vendor is reused by an attacker to reach the ERP server |
| Financial | The vendor runs out of money, is sold or cuts the product | A small ISV that writes your EDI maps is acquired and the product is retired in 12 months |
| Compliance and legal | The vendor's conduct puts you in breach of a law or a customer contract | A sales tax service misses a registration change and you owe back tax plus penalties |
| Reputational | The vendor's failure or behavior is seen as yours | A collections agency is abusive to your customers in your name |
| Concentration | Too much depends on one vendor, or on one shared provider behind many vendors | Your ERP host, your web store and your EDI network all run in the same cloud region |
| Strategic | The relationship stops fitting where you are going | A rep agency also carries a competitor's line as you expand into its territory |
| Geographic | Location adds political, legal, disaster or logistics exposure | A single contract manufacturer in a region prone to hurricanes, or offshore support with a large time zone gap |

Concentration and the vendors behind your vendors get their own page: [Fourth parties and concentration risk](/first-and-third-parties/fourth-parties-and-concentration-risk/).

## Tier your vendors by how much they could hurt you

Tiering is the step that makes TPRM affordable. The guidance calls the most important relationships the ones that support critical activities. In plain words, these are the vendors whose failure would stop you taking orders, shipping, getting paid or keeping customer data safe.

### Criticality questions

Score each vendor with five yes or no questions. Any yes on the first two makes it tier 1.

| Question | Tier 1 if yes |
|---|---|
| If this vendor stopped for a week, would we stop shipping, invoicing or collecting? | Yes |
| Does it hold or reach sensitive data: customer, employee, payment or banking data, or admin access to our systems? | Yes |
| Would replacing it take more than 90 days? | Counts toward tier 2 at least |
| Do we spend more than an agreed threshold with it each year (for example $100,000, invented)? | Counts toward tier 2 at least |
| Is it customer-facing, so its failure is visible under our name? | Counts toward tier 2 at least |

### Example tiers at a mid-sized distributor

Take an invented industrial distributor with 180 employees and about 120 active non-inventory vendors. The table shows how its vendors split across tiers.

| Tier | Share of vendors | Examples | What you do |
|---|---|---|---|
| Tier 1, critical | 8 vendors (about 7%) | ERP publisher or host, the implementation partner with admin access, EDI network, payment processor, primary 3PL, main LTL carrier, managed IT provider, backup service | Full due diligence, security evidence every year, negotiated contract, quarterly review, written exit plan |
| Tier 2, important | 30 vendors (25%) | Sales tax service, CRM, e-commerce platform, freight audit, payroll service, key add-on ISVs, rep agencies | Standard questionnaire, security evidence at signing and renewal, contract checklist, annual check-in |
| Tier 3, low | 82 vendors (about 68%) | Office supplies, cleaning, a design tool with no customer data, trade show booth | Basic form, insurance certificate where relevant, standard terms, no recurring review |

Inventory suppliers can be tiered the same way. A sole-source supplier of a line that makes up a large share of your revenue is a tier 1 relationship even though it has no access to your systems, because its failure stops sales.

:::tip[Tier the relationship, not the company]
The same vendor can be tier 1 for one service and tier 3 for another. A cloud provider that hosts your ERP is critical, while the same company's video meeting tool used by two people may not be.
:::

## A right-sized program for a 50 to 500 person company

A bank's TPRM function might have a team of analysts and a dedicated platform. You probably have one person who does this part time. That is enough if the program is built around the few vendors that matter. The table sets a minimum version of each element and the signal to grow it.

| Element | Minimum version | When to grow it |
|---|---|---|
| Owner | One named coordinator (often the controller, IT manager or COO) and a business owner per vendor | More than about 20 tier 1 and tier 2 vendors, or a customer or regulator asks for evidence |
| Policy | Two pages: what counts as a third party, the tiers, what each tier requires, who approves | Regulated data, public company controls or a customer audit |
| Inventory | A spreadsheet or a vendor field in your ERP with tier, owner, data touched, contract end date, last review | When the list passes about 150 rows or several people edit it |
| Intake | New vendors cannot be paid or given access until the form is done and a tier assigned | Tie it to AP vendor setup and IT access requests |
| Due diligence | Depth by tier, using the [vendor due diligence checklist](/first-and-third-parties/vendor-due-diligence-checklist/) | Add on-site visits or third-party assessments for the top few |
| Contracts | A contract checklist for tier 1 and 2 (see [contracts, SLAs and data rights](/first-and-third-parties/contracts-slas-and-data-rights/)) | Standard addenda you send with every tier 1 deal |
| Monitoring | Quarterly scorecard for tier 1, annual refresh of security evidence for tier 1 and 2, renewal reminders 120 days out | Automated alerts on vendor news or security ratings |
| Exit | An exit note for each tier 1 vendor: where the data is, how to get it out, the fallback | Tested exit or failover for anything that would stop shipping |
| Reporting | One page to leadership twice a year: tier 1 list, issues, overdue reviews, upcoming renewals | Board or audit committee reporting |

### Rough effort

These invented planning numbers show the shape of the work. They are not a benchmark.

| Activity | Hours each | Count per year | Hours per year |
|---|---|---|---|
| Tier 1 annual review | 12 | 8 | 96 |
| Tier 2 annual check-in | 3 | 30 | 90 |
| New vendor intake (mixed tiers) | 2 | 25 | 50 |
| Leadership report | 8 | 2 | 16 |
| Total | | | 252 |

About 250 hours a year is roughly an eighth of one full-time role. If your program costs much more than that at this size, it is probably treating tier 3 vendors like tier 1.

## How the program maps to NIST CSF 2.0

NIST CSF 2.0 (NIST CSWP 29, February 26, 2024, retrieved 2026-09-28) added a Govern function, and inside it a Cybersecurity Supply Chain Risk Management category labelled GV.SC. Its 10 outcomes read like a TPRM program described from the security side. The table restates each in plain words and names the part of your program that answers it.

| CSF 2.0 outcome | What it asks | Your program |
|---|---|---|
| GV.SC-01 | Have a supply chain risk program that leadership has agreed to | The two-page policy and a named owner |
| GV.SC-02 | Be clear who is responsible for what, on your side and the vendor's | Business owner per vendor, responsibilities in the contract |
| GV.SC-03 | Fold vendor risk into how you manage risk overall | Vendor risks appear on the same risk list as everything else |
| GV.SC-04 | Know your suppliers and rank them by criticality | The inventory and tiers |
| GV.SC-05 | Put security requirements into contracts | Contract checklist: security duties, breach notice, audit rights |
| GV.SC-06 | Plan and do due diligence before you sign | Intake form and tiered due diligence |
| GV.SC-07 | Understand, record, assess and keep watching vendor risk for the life of the relationship | Monitoring cadence and the scorecard |
| GV.SC-08 | Include key vendors in incident planning, response and recovery | Vendor contacts in your incident plan, and tabletop exercises that include them |
| GV.SC-09 | Build supply chain security into your wider security program and monitor it over the product life cycle | Access reviews, patching of vendor software, evidence refresh |
| GV.SC-10 | Plan for what happens after the relationship ends | Exit notes, data return and deletion, access removal |

If you want more depth, NIST SP 800-161 Rev. 1 is the long-form federal guidance on cybersecurity supply chain risk management, and CISA publishes free material on information and communications technology supply chain security. Both are written for large organizations, so borrow the ideas and scale down the paperwork.

## Questions to ask yourself

- Could we produce a list of every vendor with access to our systems or customer data by tomorrow?
- Which five vendors, if they disappeared tonight, would stop us shipping or collecting cash next week?
- For each of those five, do we have a current contract, a named owner, security evidence less than a year old and a written fallback?
- Who approves a new vendor, and can someone in a department sign up for a service with a credit card without anyone else knowing?
- When did we last remove a former vendor's user accounts and remote access?
- Do our key vendors know who to call here if they have an incident, and do we know who to call there?
- Does any customer contract require us to oversee our own vendors, and could we show that we do?

## Red flags in your own program

These signs show a program that exists on paper more than in use.

| Red flag | Why it matters |
|---|---|
| No inventory, or one that only lists vendors AP pays | Free tools, card-paid services and partner-provided software are invisible, and often hold data |
| Every vendor gets the same 300-question questionnaire | Tier 3 vendors ignore it, tier 1 vendors get a shallow review and the coordinator burns out |
| Security evidence collected once at signing and never again | A report from three years ago tells you nothing about today |
| No business owner per vendor | Nobody notices slipping performance or an auto-renewal until it bites |
| Vendor accounts that never expire | Old support accounts are a common way into a network |
| Exit plans written only when you are already leaving | By then you have the least bargaining power and the least time |
| The program lives in one person's head | It stops when that person is on vacation or leaves |

## Start the program in six steps

1. **Build the list.** Pull every payee from AP for the last 24 months, add card-paid subscriptions and anything IT knows has access and remove one-off purchases.
2. **Tier it.** Run the criticality questions on every row. Expect a small tier 1 and a long tier 3.
3. **Fix tier 1 first.** For each tier 1 vendor, confirm a named owner, a current contract, recent security evidence and a one-paragraph exit note.
4. **Put a gate on new vendors.** No payment and no access until the intake form is done and a tier is assigned.
5. **Set the calendar.** Quarterly tier 1 reviews, annual evidence refresh for tier 1 and 2, renewal reminders 120 days out.
6. **Report twice a year.** One page to leadership keeps the program alive.

## Sources

- [Interagency Guidance on Third-Party Relationships: Risk Management (Federal Register, June 9, 2023)](https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management)
- [SR 23-4, Interagency Guidance on Third-Party Relationships: Risk Management (Federal Reserve)](https://www.federalreserve.gov/supervisionreg/srletters/SR2304.htm)
- [OCC Bulletin 2023-17, Third-Party Relationships: Interagency Guidance on Risk Management](https://www.occ.gov/news-issuances/bulletins/2023/bulletin-2023-17.html)
- [FIL-29-2023, Interagency Guidance on Third-Party Relationships: Risk Management (FDIC)](https://www.fdic.gov/news/financial-institution-letters/2023/fil23029.html)
- [The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024)](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)
- [SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations (NIST)](https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final)
- [Information and Communications Technology Supply Chain Security (CISA)](https://www.cisa.gov/topics/information-communications-technology-supply-chain-security)

---

Epicor, Prophet 21, P21 and DynaChange are trademarks or registered trademarks of Epicor Software Corporation registered in the United States and other countries. Kinetic is a trademark of Epicor Software Corporation. Lumina ERP is an independent consultancy and is not affiliated with, sponsored by or endorsed by Epicor.