Blog

How to start a third-party risk management program: Get leadership buy-in

Create a TPRM program that addresses your organization’s highest security risks and aligns with strategic objectives

Katrina Dalao
Sr. Content Marketing Specialist, CIPM
July 11, 2023

How do you define the scope of your TPRM program?
What’s the best way to get buy-in from leadership?
Getting started with your TPRM program

InfoSec's guide to third-party risk management: Key considerations and best practices

Learn practical advice on how to approach third-party risk management like an InfoSec expert.

Working with third parties is nothing new for most organizations. By the time leadership decides to start a formal third-party risk management (TPRM) program, there’s often multiple third-party relationships already in motion. This makes it challenging to create a TPRM program that addresses all vendors, suppliers, and third parties — each posing its own unique risks to the organization.

To help navigate the winding road of third-party risk management, we spoke with six InfoSec and third-party risk leaders from OneTrust and Fortune Global 500 companie about their approach to building a TPRM program and the lessons they learned along the way.

Whether you’re working with one or 1,000 third parties, establishing a TPRM program follows these general steps:

Scope and get leadership buy-in for your TPRM program
Identify and understand types of third-party risk
Implement TPRM across your organization
Maintain and monitor your TPRM program

In this post, we cover the first step of building your TPRM program: Scoping your program and getting leadership buy-in.

Download our InfoSec's guide to third-party risk management, which covers all the steps in setting up a TPRM program, from planning to monitoring and reporting.

How do you define the scope of your TPRM program?

While every TPRM manager wants a program that actively mitigates all third-party risks, the reality is that not all relationships need to be evaluated at the same level. It takes significant resources to perform security checks, risk reviews, and other due diligence tasks — which aren’t always available, especially at the start of a TPRM program.

Defining your program scope helps establish clear boundaries, deliverables, and timelines, and keeps the focus on efforts that deliver the highest value.

“There are a lot of considerations, but early on, you're trying to knock out the low-hanging fruit and figure out your risk exposure based on the partners you have,” says Tim Mullen, Chief Information Security Officer, OneTrust. "We’re going to have a lot more rigor when it comes to reviewing a security or financial services vendor versus a vendor that provides us with something like paper towels or toilet paper.”

Use these questions to help set the scope for your TPRM program:

What are the goals of your TPRM program?
Do you have specific compliance requirements or deliverables (i.e., for publicly traded companies or regulated industries)?
What risk domains should be managed (i.e., InfoSec, privacy, financial, reputational)?
What is the organization’s appetite for risk?

“Start small with a minimum viable product, something that can improve the security posture right here, right now.”

—Zuzana Rebrova, Head of Third-Party Cyber Risk Management, Swiss Re

Next, take inventory of your current suppliers, contractors, partners, and other vendors, and determine which of the third parties will be included in the scope of your TPRM program.

The following questions can help determine if a third party is in or out of scope for your TPRM program:

What type of services are they providing?
What data do they have access to?
Will they process or host any of your data?
What functions or teams rely on the third party to operate?
What are the costs and terms of your relationship (i.e., contractual, subscription, one-time project)?
Are there any integrations between your systems?
Will they be embedded into your product?
Can they show certification or compliance with security regulations?
What type of risks do they pose?
How critical are they to your organization?

This inventory serves as a single source of information and helps organizations better categorize third parties according to risk. Therefore, it’s important to update third-party inventories with any new, terminated, or revised vendor contracts.

“Third parties are just another asset you're trying to manage. And with any asset, there’s always a level of risk or a threat that comes with it,” says Kevin Liu, Senior Director of Information Security at OneTrust.

“Identify third-party risks and understand their potential exposure and impact to the organization. Then, once you have those things, you can create an assessment process and assign a criticality to the third party.”

Once the scope and other details are defined, it’s time to present the TPRM program to the leadership team.

Learn everything you need to know about third-party risk management in this guide that covers best practices, the TPRM lifecycle, and more.

What’s the best way to get buy-in from leadership?

All the experts we interviewed aligned on one universal tenet: Getting buy-in from leadership is critical to the success of your TPRM program.

“Start from the top. Management needs to understand that third-party risk really matters, what the impact could be, and how it could affect the company,” says Zuzana Rebrova, Head of Third-Party Cyber Risk Management at Swiss Re.

This involves presenting the program objectives and strategies for achieving them, as well as the business case for how a TPRM program effectively protects the organization against risks and potential losses.

Whether it’s the board, C-suite, or other key stakeholders, having top-level support goes a long way in fostering a risk culture. Leadership can not only champion the program, but also help establish governance for how TPRM activities integrate into day-to-day operations.

“The more you coordinate and socialize your intended outcome with the leaders and stakeholders in the organization, the more you’re able to set resource levels, measure whether you're actually achieving the value you want, and structure your program accordingly,” says Matthew Solomon, VP of Technology and Cyber Risk Management at Humana.

Ultimately, TPRM is an organization-wide exercise requiring involvement from multiple teams. While InfoSec or compliance typically oversees TPRM, anyone who deals with third parties — including privacy, procurement, finance, and legal — needs to be aligned and in agreement with the program.

Getting started with your TPRM program

Taking the time to plan your third-party management program sets you up for success in the long run. The best way to start your TPRM program is to get leadership and stakeholder buy-in early on and then define the program scope in a way that mitigates the highest risks and aligns to strategic objectives.

Reduce risk, build trust, and enhance business resilience by unifying third-party management across privacy, security, ethics, and ESG. Book a demo today.

Blog

How to start a third-party risk management program: Get leadership buy-in

Table of contents

InfoSec's guide to third-party risk management: Key considerations and best practices

How do you define the scope of your TPRM program?

What’s the best way to get buy-in from leadership?

Getting started with your TPRM program

You may also like

Technology Risk & Compliance

Unifying third-party and tech risk in an AI-driven world

Join our webinar to learn how risk and security leaders are aligning third-party and tech risk for scalable, AI-ready compliance programs.

July 08, 2025

Third-Party Risk

Integrated risk management: Aligning third party risk across the enterprise

Join this session to explore strategies for breaking down silos, integrating risk insights, and strengthening security and compliance postures with a unified risk management approach.

May 21, 2025

Third-Party Risk

Spring 2025 product release for third-party management

OneTrust’s spring 2025 product release introduces three powerful features designed to accelerate contextual risk visibility by streamlining third-party risk assessment processes.

May 09, 2025

Third-Party Risk

Beyond compliance: Scaling third-party risk management with automation

Join this live webinar to explore how automated vendor assessments, real-time monitoring, and compliance workflows can enhance risk insights and operational efficiency.

May 07, 2025

Third-Party Risk

Laying the foundation for effective third-party risk management

Join this webinar to discover how automation enhances third-party risk management. Learn best practices for vendor risk assessment, due diligence, and compliance.

April 30, 2025

Third-Party Risk

Navigating the U.S. DOJ Cybersecurity Rule on Cross-Border Data Transfers: Key insights & compliance strategies

Join OneTrust and Deloitte to explore the U.S. DOJ Cybersecurity Rule, key risks, and best practices for managing cross-border data transfers and ensuring compliance.

April 21, 2025

Third-Party Risk

Empowering business with Unified Data Privacy & TPRM

Join our webinar to explore actionable strategies powered by OneTrust solutions to foster collaboration across privacy and TPRM stakeholders to better support your organizations.

April 03, 2025

Third-Party Risk

Understanding the DORA: Unpacking risk and compliance requirements and best practices

Join our expert panel to explore DORA compliance post-deadline. Learn key lessons, risk challenges, and best practices for operational resilience.

April 01, 2025

Third-Party Due Diligence

Understanding and implementing APRA's CPS 230 Standard

For financial institutions in Australia, the Australian Prudential Regulation Authority’s (APRA) CPS 230 standard is a clarion call to fortify cyber resilience.

February 05, 2025

Third-Party Risk

Live Demo: Building a more resilient Third-Party Management program

Register for our live demo webinar to see how OneTrust Third-Party Management can revolutionize your third-party risk management approach.

January 30, 2025

Third-Party Risk

DORA Compliance Countdown: Are you ready?

Join us to learn more about the Digital Operational Resilience Act (DORA) and how OneTrust can help organizations research, implement, and monitor compliance at scale with DORA and other related regulations and standards like NIS2 and ISO.

January 16, 2025

Third-Party Risk

Are you ready for DORA compliance?

The Digital Operational Resilience Act (DORA) is the first regulation to oversee the security functions of financial entities across the European Union.

January 16, 2025

Third-Party Risk

Virtual Lunch and Learn: A deep dive into OneTrust's Third Party Management capabilities

Join us for a virtual Lunch & Learn session and explore how OneTrust’s Third Party Management solution can streamline your risk management processes.

December 17, 2024

Technology Risk & Compliance

The PDPL in Saudi Arabia is now in effect: is your business ready?

Join our Saudi Arabia PDPL webinar for an overview on the data protection law, its requirements, and how to prepare for full enforcement.

December 12, 2024

Third-Party Risk

Unpacking global regulatory frameworks to enhance third-party operational resilience

Register for this OneTrust webinar to learn about the relevant resilience focused requirements of DORA, NIS 2, and other global regulations.

December 11, 2024

OneTrust named a Leader in Operational Resilience Software 2024

Download this Verdantix report to learn the importance of operational resilience for your business and why OneTrust was named a leader in the space.

December 05, 2024

Technology Risk & Compliance

Understanding the NIS 2 Directive: Compliance insights and best practices

This DataGuidance webinar explores the latest and expected developments in the implementation of the NIS 2 Directive, focusing on practical compliance strategies to ensure your organization is prepared.

December 04, 2024

Third-Party Risk

Rise above risk: Third-party management in technology

This infographic gives an overview on how third-party management affects technology, growing threats, and how OneTrust Third-Party Management can help combat them.

November 21, 2024

Third-Party Risk

APAC - Third-party risk management and due diligence: What’s the difference and why does it matter?