Third-party risk management for mid-sized companies

Any ERP

ExplanationIntermediate11 min read

In short. Third-party risk management is the habit of knowing which outside businesses you depend on, how badly each one could hurt you and checking the important ones before you sign and while you use them. A mid-sized distributor does not need a bank's program: an inventory, three criticality tiers, a due diligence depth per tier and an annual review of the top tier cover most of the risk.

Written for Leaders, finance and operations, administrators.

Third-party risk management (TPRM) means knowing which outside businesses you rely on, deciding how much each could hurt you if it failed and matching the effort you spend on each to that answer. For a mid-sized distributor the honest version is small: a list of vendors, three tiers, a due diligence depth per tier, a contract checklist and a yearly look at the handful that could stop you shipping. Below, we take the lifecycle the U.S. bank regulators published in 2023, cut it down to what a 50 to 500 person company can sustain and map it to the supply chain part of NIST CSF 2.0.

At a glance

The table answers the common first questions.

Question	Short answer
What is a third party?	Any outside business you have an ongoing arrangement with: software vendors, hosting, 3PLs, carriers, payment and tax services, consultants, reps, key suppliers
Why bother?	You can outsource the work but not the consequences. When a vendor fails, your customers see your name
What is the core tool?	An inventory with a criticality tier on every row
How much effort?	Heavy for tier 1 (a few vendors), light for tier 2, a form and a contract check for tier 3
Who owns it?	One named person coordinates, and each vendor has a business owner who answers for it
Which frameworks help?	The 2023 interagency guidance for the lifecycle, NIST CSF 2.0 GV.SC for the security side, NIST SP 800-161 if you want depth

Where the lifecycle comes from

In June 2023 the Federal Reserve, the FDIC and the OCC replaced their separate vendor guidance with one document, the Interagency Guidance on Third-Party Relationships: Risk Management (Federal Register, June 9, 2023, retrieved 2026-09-28). It is written for banks, but it is the clearest public description of how to manage outside businesses. It says plainly that the effort should match the risk and complexity of each relationship. That principle is what makes it usable for a distributor.

The guidance describes a lifecycle with five stages, wrapped in governance.

Stage	Guidance aim	At a distributor
Planning	Decide whether to use a third party at all, and understand the risks before you look at vendors	A one-page business case: why outside, what it touches, what happens if it fails, who owns it
Due diligence and selection	Check that the vendor can do the work safely and will still be around	Questionnaire, references, financial check, security evidence, depth set by tier
Contract negotiation	Put expectations, rights and remedies in writing	Service levels, data ownership, security duties, breach notice, audit rights, exit help
Ongoing monitoring	Keep checking performance and risk while the relationship runs	Quarterly scorecard for tier 1, annual review of evidence, watch for ownership changes
Termination	Leave in an orderly way, with your data and without a gap in service	Exit plan written at signing, data return and deletion confirmed, access removed

The governance wrapper is three things: someone is accountable (oversight and accountability), someone independent occasionally checks that the process is followed (independent review) and you keep records good enough to show what you decided and why (documentation and reporting).

The risks you are managing

Most vendor problems fall into a handful of types. One vendor usually carries several at once, and the tier you give it should reflect the worst of them.

Risk type	What it means	Example (invented)
Operational	The vendor cannot deliver the service as agreed	A 3PL mis-ships 4% of orders for three weeks during peak
Cyber and information security	The vendor, or its access into you, becomes the way an attacker or a leak reaches your data	A remote support tool account for an add-on vendor is reused by an attacker to reach the ERP server
Financial	The vendor runs out of money, is sold or cuts the product	A small ISV that writes your EDI maps is acquired and the product is retired in 12 months
Compliance and legal	The vendor's conduct puts you in breach of a law or a customer contract	A sales tax service misses a registration change and you owe back tax plus penalties
Reputational	The vendor's failure or behavior is seen as yours	A collections agency is abusive to your customers in your name
Concentration	Too much depends on one vendor, or on one shared provider behind many vendors	Your ERP host, your web store and your EDI network all run in the same cloud region
Strategic	The relationship stops fitting where you are going	A rep agency also carries a competitor's line as you expand into its territory
Geographic	Location adds political, legal, disaster or logistics exposure	A single contract manufacturer in a region prone to hurricanes, or offshore support with a large time zone gap

Concentration and the vendors behind your vendors get their own page: Fourth parties and concentration risk.

Tier your vendors by how much they could hurt you

Tiering is the step that makes TPRM affordable. The guidance calls the most important relationships the ones that support critical activities. In plain words, these are the vendors whose failure would stop you taking orders, shipping, getting paid or keeping customer data safe.

Criticality questions

Score each vendor with five yes or no questions. Any yes on the first two makes it tier 1.

Question	Tier 1 if yes
If this vendor stopped for a week, would we stop shipping, invoicing or collecting?	Yes
Does it hold or reach sensitive data: customer, employee, payment or banking data, or admin access to our systems?	Yes
Would replacing it take more than 90 days?	Counts toward tier 2 at least
Do we spend more than an agreed threshold with it each year (for example $100,000, invented)?	Counts toward tier 2 at least
Is it customer-facing, so its failure is visible under our name?	Counts toward tier 2 at least

Example tiers at a mid-sized distributor

Take an invented industrial distributor with 180 employees and about 120 active non-inventory vendors. The table shows how its vendors split across tiers.

Tier	Share of vendors	Examples	What you do
Tier 1, critical	8 vendors (about 7%)	ERP publisher or host, the implementation partner with admin access, EDI network, payment processor, primary 3PL, main LTL carrier, managed IT provider, backup service	Full due diligence, security evidence every year, negotiated contract, quarterly review, written exit plan
Tier 2, important	30 vendors (25%)	Sales tax service, CRM, e-commerce platform, freight audit, payroll service, key add-on ISVs, rep agencies	Standard questionnaire, security evidence at signing and renewal, contract checklist, annual check-in
Tier 3, low	82 vendors (about 68%)	Office supplies, cleaning, a design tool with no customer data, trade show booth	Basic form, insurance certificate where relevant, standard terms, no recurring review

Inventory suppliers can be tiered the same way. A sole-source supplier of a line that makes up a large share of your revenue is a tier 1 relationship even though it has no access to your systems, because its failure stops sales.

A right-sized program for a 50 to 500 person company

A bank's TPRM function might have a team of analysts and a dedicated platform. You probably have one person who does this part time. That is enough if the program is built around the few vendors that matter. The table sets a minimum version of each element and the signal to grow it.

Element	Minimum version	When to grow it
Owner	One named coordinator (often the controller, IT manager or COO) and a business owner per vendor	More than about 20 tier 1 and tier 2 vendors, or a customer or regulator asks for evidence
Policy	Two pages: what counts as a third party, the tiers, what each tier requires, who approves	Regulated data, public company controls or a customer audit
Inventory	A spreadsheet or a vendor field in your ERP with tier, owner, data touched, contract end date, last review	When the list passes about 150 rows or several people edit it
Intake	New vendors cannot be paid or given access until the form is done and a tier assigned	Tie it to AP vendor setup and IT access requests
Due diligence	Depth by tier, using the vendor due diligence checklist	Add on-site visits or third-party assessments for the top few
Contracts	A contract checklist for tier 1 and 2 (see contracts, SLAs and data rights)	Standard addenda you send with every tier 1 deal
Monitoring	Quarterly scorecard for tier 1, annual refresh of security evidence for tier 1 and 2, renewal reminders 120 days out	Automated alerts on vendor news or security ratings
Exit	An exit note for each tier 1 vendor: where the data is, how to get it out, the fallback	Tested exit or failover for anything that would stop shipping
Reporting	One page to leadership twice a year: tier 1 list, issues, overdue reviews, upcoming renewals	Board or audit committee reporting

Rough effort

These invented planning numbers show the shape of the work. They are not a benchmark.

Activity	Hours each	Count per year	Hours per year
Tier 1 annual review	12	8	96
Tier 2 annual check-in	3	30	90
New vendor intake (mixed tiers)	2	25	50
Leadership report	8	2	16
Total			252

About 250 hours a year is roughly an eighth of one full-time role. If your program costs much more than that at this size, it is probably treating tier 3 vendors like tier 1.

How the program maps to NIST CSF 2.0

NIST CSF 2.0 (NIST CSWP 29, February 26, 2024, retrieved 2026-09-28) added a Govern function, and inside it a Cybersecurity Supply Chain Risk Management category labelled GV.SC. Its 10 outcomes read like a TPRM program described from the security side. The table restates each in plain words and names the part of your program that answers it.

CSF 2.0 outcome	What it asks	Your program
GV.SC-01	Have a supply chain risk program that leadership has agreed to	The two-page policy and a named owner
GV.SC-02	Be clear who is responsible for what, on your side and the vendor's	Business owner per vendor, responsibilities in the contract
GV.SC-03	Fold vendor risk into how you manage risk overall	Vendor risks appear on the same risk list as everything else
GV.SC-04	Know your suppliers and rank them by criticality	The inventory and tiers
GV.SC-05	Put security requirements into contracts	Contract checklist: security duties, breach notice, audit rights
GV.SC-06	Plan and do due diligence before you sign	Intake form and tiered due diligence
GV.SC-07	Understand, record, assess and keep watching vendor risk for the life of the relationship	Monitoring cadence and the scorecard
GV.SC-08	Include key vendors in incident planning, response and recovery	Vendor contacts in your incident plan, and tabletop exercises that include them
GV.SC-09	Build supply chain security into your wider security program and monitor it over the product life cycle	Access reviews, patching of vendor software, evidence refresh
GV.SC-10	Plan for what happens after the relationship ends	Exit notes, data return and deletion, access removal

If you want more depth, NIST SP 800-161 Rev. 1 is the long-form federal guidance on cybersecurity supply chain risk management, and CISA publishes free material on information and communications technology supply chain security. Both are written for large organizations, so borrow the ideas and scale down the paperwork.

Questions to ask yourself

Could we produce a list of every vendor with access to our systems or customer data by tomorrow?
Which five vendors, if they disappeared tonight, would stop us shipping or collecting cash next week?
For each of those five, do we have a current contract, a named owner, security evidence less than a year old and a written fallback?
Who approves a new vendor, and can someone in a department sign up for a service with a credit card without anyone else knowing?
When did we last remove a former vendor's user accounts and remote access?
Do our key vendors know who to call here if they have an incident, and do we know who to call there?
Does any customer contract require us to oversee our own vendors, and could we show that we do?

Red flags in your own program

These signs show a program that exists on paper more than in use.

Red flag	Why it matters
No inventory, or one that only lists vendors AP pays	Free tools, card-paid services and partner-provided software are invisible, and often hold data
Every vendor gets the same 300-question questionnaire	Tier 3 vendors ignore it, tier 1 vendors get a shallow review and the coordinator burns out
Security evidence collected once at signing and never again	A report from three years ago tells you nothing about today
No business owner per vendor	Nobody notices slipping performance or an auto-renewal until it bites
Vendor accounts that never expire	Old support accounts are a common way into a network
Exit plans written only when you are already leaving	By then you have the least bargaining power and the least time
The program lives in one person's head	It stops when that person is on vacation or leaves

Start the program in six steps

Build the list. Pull every payee from AP for the last 24 months, add card-paid subscriptions and anything IT knows has access and remove one-off purchases.
Tier it. Run the criticality questions on every row. Expect a small tier 1 and a long tier 3.
Fix tier 1 first. For each tier 1 vendor, confirm a named owner, a current contract, recent security evidence and a one-paragraph exit note.
Put a gate on new vendors. No payment and no access until the intake form is done and a tier is assigned.
Set the calendar. Quarterly tier 1 reviews, annual evidence refresh for tier 1 and 2, renewal reminders 120 days out.
Report twice a year. One page to leadership keeps the program alive.