Third-Party Risk Management: A Practical Guide for SMEs and Mid-Sized Companies

Why Third-Party Risk Is Actually Your Risk

Third-party events, first-party losses

Third-party events produce first-party losses. The risk lives in your income statement, your operations, your customer relationships. The "third party" label can create a false sense of distance — a feeling that this is someone else's problem. It is not. Third-party risk is just first-party risk with an external trigger.

This reframe matters because it changes what you are trying to do. You are not trying to audit your vendors into perfect security. You are trying to understand how much of your own business value is exposed through those relationships — and what it would cost you if something went wrong.

Why mid-sized companies are more exposed than they realize

Third-party incidents can be survivable or they can be existential — and for a mid-sized company, the line between the two is closer than most leaders realize.

When Marks & Spencer lost an estimated £300 million in profit through a third-party incident, it was painful. It made headlines. But Marks & Spencer is still in business. Now consider the other side of that dynamic. When Jaguar Land Rover was hit, many of the smaller suppliers in their ecosystem, companies with too much revenue concentrated in that one relationship, did not survive.

The losses might be smaller in absolute terms, but the consequences can be existential. A startup software company whose development platform leaks their IP does not have a business anymore. A small e-commerce company whose hosting provider goes down for 48 hours may not recover the lost revenue or the customer trust.

Mid-sized companies also tend to operate lean. When an incident occurs, your recovery depends on resources that may simply not be there.

Identifying Which Third Parties Put Your Business at Risk

Revenue, data and infrastructure

Not all vendor relationships carry the same risk. The vendors that matter most to your third-party risk management program are the ones with meaningful access to the things that keep your business running. There are four categories to consider.

1. Revenue streams: Does this vendor run or host the revenue generating systems?

If they go down or are compromised, does your business stop generating income? Vendors with direct access to how you make money represent your highest-exposure relationships.

2. Data: What sensitive data does this vendor hold, process, or transmit?

A breach of customer PII can trigger regulatory fines, mandatory disclosure obligations, and lasting damage to customer trust — often simultaneously. Loss of IP can be worse: depending on your business, it can eliminate your competitive advantage entirely.

3. Infrastructure: Does this vendor have access to your systems and networks, even if they do not directly hold sensitive data?

Managed IT providers, outsourced help desks, and remote monitoring tools often carry privileged access — which makes them a high-value target even when they are not holding anything sensitive themselves.

The Marks & Spencer incident is instructive here. The third party involved in their breach was a managed service provider running the help desk. They were not storing sensitive customer data. But they had access to systems. A gateway vendor does not need to hold your most sensitive data to put it at risk.

The key question for any vendor in your ecosystem is simple: if this relationship were compromised, what would it realistically cost my business? That question is where your supply chain risk assessment should start.

Why vendor questionnaires alone are not enough

Most organizations approach third-party risk management as a compliance exercise: you send a questionnaire, the vendor responds, you file the response. The box is ticked.

If your own company has ever been asked to complete one of these, you already know their limitations:

• The answers depend on who fills it out
• The questions are often generic and the responses self-reported
• Verification rarely happens
• Everyone involved understands the primary purpose is to satisfy an audit requirement, not produce an accurate picture of risk

That does not mean questionnaires are worthless. They create a paper trail, establish baseline expectations, and can surface obvious gaps. But they tell you what a vendor claims, not what they actually do.

The most productive complement to a questionnaire is focusing on what you can control on your own side. How are you limiting vendor access? How are you segmenting your network? What compensating controls do you have in place so that even a compromised vendor cannot reach your most critical assets?

Building a Proportionate Third-Party Risk Management Program

A third-party risk program is not a one-time audit. It is a lifecycle that applies from the moment you consider a new vendor through to the point you offboard them.

Vendor inventory and risk tiering

You cannot manage what you have not identified. The first step is to take an inventory of your third parties with access to your systems, data, or business-critical operations.

Once you have that inventory, the most important discipline is risk tiering, recognizing that not all vendors present the same level of risk, and allocating your attention accordingly.

How you tier each vendor will determine how you address your internal security controls. Focusing your effort on the vendors that represent genuine material risk is more effective than applying the same assessment to every supplier on your list.

Contracts, technical controls, and ongoing monitoring

Contracts create legal obligations. Security requirements that are not documented contractually are not enforceable. At minimum, critical vendor contracts should include:

• Security standards the vendor must maintain
• A breach notification obligation with a defined timeline
• Your right to audit
• Restrictions on sub-processors accessing your data
• Data return or deletion requirements at contract end

Technical controls limit what is possible if a vendor relationship is compromised. Network segmentation ensures vendor remote access reaches only what it needs to. MFA on every external connection eliminates the majority of credential-based intrusion risk. Scoped and regularly reviewed access permissions prevent privilege creep. Logging of all vendor activity on your systems is increasingly required by regulators and is essential for incident investigation.

Monitoring keeps the picture current. A vendor's security posture at contract signing can change significantly within months. Reassessments should be scheduled by tier — more frequently for critical vendors — and triggered by material events: a vendor announces a breach, is acquired, introduces new sub-processors, or shows signs of financial distress. When a vendor relationship ends, revoke all access immediately.

Where to Start with TPRM

If you do not currently have a structured TPRM program, the path forward is more straightforward than it might seem. You do not need to audit every vendor or achieve perfect visibility on day one. You need to start with the relationships that could materially damage your business.

• Build your vendor inventory List every third party with access to your systems or data. Note what they access and why. Revoke anything that is no longer required. ‍
• Tier your vendors. Apply the three-question test: revenue exposure, data sensitivity, infrastructure access. Assign each vendor to a risk tier.
• ‍Assess your critical vendors first. Confirm that data processing agreements are in place, request evidence of certifications, and review whether your contracts contain any security obligations at all. ‍
• Fix the most obvious gaps. Confirm MFA is enforced on all external connections. Identify contracts with no security clauses and flag them for renewal or addendum. ‍
• Build ownership and cadence. Name an internal owner for each critical vendor relationship. Put reassessments in the calendar. Make this a process, not a one-off project.

That is a real, proportionate TPRM program. It will not cover everything immediately. But it will give you visibility into your most significant exposures — and that is where third-party risk management has to begin.