Getting started4 min read
Third-party risk management: a practical guide.
Build a TPRM programme with a vendor inventory, security assessments and ongoing third-party monitoring.
A useful vendor risk programme starts with a shared picture of the businesses you depend on. Before choosing a questionnaire or deciding which score needs attention, establish who your vendors are, what they do, and who can make a decision about each relationship.
Build an inventory people can use.
Bring together vendor lists from procurement, finance, IT and business owners. Record the vendor’s name, primary domain, service, internal owner and current status. Resolve duplicate names and confirm that the domain belongs to the service you actually use. A parent company and a product can have different operating boundaries.
Keep the first version manageable. A short inventory with reliable ownership is more useful than a detailed spreadsheet nobody maintains. DarkRisk’s vendor inventory gives the assessment a shared starting point; your team provides the business context that makes each entry meaningful.
Understand the relationship.
Ask what would happen if the vendor became unavailable. Identify the information it handles, the access it receives and the processes it supports. A payroll provider, a public website tool and an office supplier deserve different assessment depth because the consequences of an incident differ.
Write down your prioritisation criteria so another team member can apply them consistently. Where you discover a dependency on another provider, record it too. Fourth-party mapping helps make those relationships visible, while a conversation with the vendor adds context that a technical observation may not reveal.
Combine observations with evidence.
Run an external scan against the confirmed vendor domain, then review the individual findings. The score is an entry point into the assessment. Check what was observed, when it was observed and whether the affected asset is relevant to your relationship.
Use questionnaires to investigate controls that cannot be seen from outside. Request supporting documents when an answer needs evidence, and keep that material alongside the assessment. If a scan and an answer appear inconsistent, make the difference a specific follow-up question instead of immediately treating either as conclusive.
Make the next decision explicit.
An assessment should lead to a clear next step: proceed, seek more evidence, ask for an improvement, or escalate to the person who can accept the risk. Record the reasoning, the open questions and the owner. This makes a later review easier to understand.
When reporting to leadership, connect a technical finding to the business service involved. Executive PDF reports can support that conversation, but add your own decision context. The reader should understand why the vendor matters and what the team is doing next.
Give the programme a rhythm.
Set a review cadence around the importance of the relationship and the pace of change. Scheduled monitoring can help surface changes in observable exposure. Revisit business context when access expands, a contract changes or a new service is introduced.
Start with a small group of meaningful vendors and complete the full cycle. Use what you learn to refine the process before extending it across the portfolio. A repeatable review with an accountable owner is a stronger foundation than a one-off exercise that ends with a score.
The short version
Start with a trustworthy inventory, add business context, and make every assessment lead to an owned decision. Expand the programme once that loop works.