Third Party Risk: You Outsourced the Service, Not the Risk

Count the outside companies that touch your data on an ordinary day. The payroll provider. The email platform. The hosting company. The CRM. The IT support firm with administrator access to half your servers. For most organisations the answer runs into dozens, and nobody has the complete list.

Each of those relationships moved a service outside your walls. None of them moved the accountability. When a supplier is breached and your customers' data is exposed, everyone asks the same question: what did you do to check?

Verizon's 2025 Data Breach Investigations Report found that third party involvement in breaches had doubled, to 30 percent. Attackers have learned that the easiest way in is often through someone you already trust.

Why the questionnaire is not working

The usual answer to vendor risk is a long security questionnaire. It feels like control. In practice it rarely is. The vendor marks its own homework, often through its sales team. The answers are a snapshot that ages quickly. The catering supplier and the cloud provider holding your customer data answer the same three hundred questions. And when an answer is bad, the contract is often signed anyway.

A practical approach

1. Know who you depend on

Build the inventory from where vendors actually appear: payments, procurement, app integrations, remote access rules and expensed subscriptions. The gap between this list and the approved vendor list is usually the first finding.

2. Focus on the few that matter

Rank each vendor on three questions. What data do they hold? What access do they have into our systems? How badly would we be hurt if they stopped tomorrow? A small number of critical vendors will rise to the top. That is where the effort belongs.

3. Ask for evidence, not answers

For critical vendors, ask for an independent report or certificate, such as SOC 2 or ISO 27001, and check that its scope covers the service you actually buy. Then ask a handful of pointed questions: is multifactor authentication enforced for everyone who can reach our data, how quickly would you tell us about a breach, and when did you last restore from backup?

4. Put it in the contract

Your leverage is greatest before signing. Contracts with critical vendors should cover security obligations, breach notification within a set number of hours, the right to request evidence, the subcontractors who handle your data, and how data is returned or deleted at the end.

You can outsource a service. You cannot outsource accountability for it.

5. Control what they can reach

This is the most overlooked step and often the cheapest. Vendor access should be named, never shared, protected by multifactor authentication, limited to the job, logged, and removed the day the contract ends. Many supplier breaches travel along remote access that nobody remembered was still open.

6. Plan for their breach

Most incident plans assume the attack happens to you. Add the scenario where it happens to a critical supplier: who calls whom, how you cut their access, what you must tell customers, and what you do if the service is gone for a week. Remember that your vendors have vendors too, and that several critical services may depend on the same underlying provider.

Five questions for leadership

Do we have a complete list of vendors that hold our data or access our systems?
Which are critical, and what independent evidence do we hold on each?
Who has remote access into our environment today?
How quickly must our critical vendors tell us about a breach?
If our most important supplier failed tomorrow, what would we do on day one?

Outsourcing is not the problem. Treating the signature on the contract as the end of the risk conversation is. Know who you depend on, focus on the few who matter most, ask for evidence and keep the doors you open for them under your control.