Third-Party Risk Management

Q: What third-party risk requirements appear in contracts?

Common requirements: prior written approval for sub-processors, annual vendor security assessments, flow-down of security obligations, restrictions on data access by foreign nationals, and notification within 30 days of sub-processor changes.

ClauseOps

Third-party risk management (TPRM) is the process of identifying, assessing, monitoring, and mitigating risks that arise from an organization's relationships with third parties including vendors, suppliers, contractors, and business partners. Enterprise contracts typically include third-party risk…