The TPRM lifecycle structures the management of third-party risks in sequential phases — from the first identification of a supplier to the orderly termination of the business relationship.
Phases 1–3: Onboarding and Assessment
The lifecycle begins with the identification and inventory of all third parties. This is followed by risk classification by criticality — which suppliers have access to critical systems or data? In phase three, due diligence is conducted: security questionnaires, certificate reviews and external cyber intelligence data feed into the risk assessment.
360TPRM replaces manual questionnaires with automated cyber intelligence scans — results in minutes rather than weeks.
Phases 4–6: Contract, Monitoring and Exit
In phase four, security requirements are anchored in contracts and SLAs. Phase five — continuous monitoring — is the most critical phase: supplier risks change daily, which is why NIS2 and DORA explicitly require continuous monitoring. Phase six governs orderly exit management when a supplier relationship ends.
72% of organisations monitor suppliers only annually — yet cyber risks change daily. Continuous monitoring is not optional but a regulatory requirement.
FAQ
Automate the TPRM lifecycle
See in a 45-minute demo how 360TPRM specifically meets your requirements.
Request free demo →