How to Perform Third-Party Risk Assessment: Steps & Templates

Quick summary

This guide provides a technical framework for conducting third-party risk assessments across your entire supply chain. It distinguishes broader third-party risk management from traditional vendor oversight to ensure all external partners are evaluated. You will find an eight-step execution process, a checklist of commonly missed aspects like shadow third parties and exit strategies, and six expert-designed templates tiered for standard and high-risk entities. We include sample reports and SME insights to help you evaluate frameworks such as ISO 27001 and GDPR. Finally, we explore how AI-native tools automate continuous monitoring.

Key factors for third-party risk assessment in TPRM

When building a third-party risk assessment program, five factors should shape how you prioritize and structure your evaluations: vendor criticality, data access, regulatory context, lifecycle stage, and fourth-party exposure. Together, these help ensure your assessment efforts align with actual risk rather than just completing a checklist.

It's also important to recognize that third-party assessments extend well beyond security questionnaires. A complete evaluation accounts for a partner's financial stability, ESG practices, and geopolitical exposure — not just their cybersecurity controls. The stakes are significant: Verizon's 2025 Data Breach Investigations Report estimates that third parties account for roughly 30% of all breaches, underscoring why partners must be assessed continuously, from onboarding through secure offboarding.

Use these five factors to determine the depth and focus of each third-party risk assessment:

• Vendor criticality: This factor assesses the extent to which your operations would be affected if a partner failed, and whether that failure exceeds your risk appetite. It sits at the core of vendor risk management (VRM), and if a vendor is critical, you need to review their business continuity plans so your core functions are not disrupted.
  
  
• Data access level: Check whether a partner handles only public information or has access to sensitive data, such as healthcare or financial records.
  
  
• Regulatory context: Make sure your assessments check for compliance with rules like GDPR for privacy or HIPAA for healthcare. Compliance requirements depend on the industry and location of both you and your partner.
  
  
• Lifecycle stage: Adjust your assessments as needed, whether you are checking new partners during onboarding, monitoring them over time, or ensuring data is securely destroyed when the partnership ends.
  
  
• Nth-party risk: Remember to consider your third party’s own subcontractors, which is also called fourth-party risk. Even if your partner is secure, their main subcontractor could still be a weak link if they do not have basic protections in place.
  
  

How to perform a third-party risk assessment step-by-step

A third-party risk assessment is performed in eight steps: inventory and categorize partners, map regulations and frameworks, score inherent risk, send tiered questionnaires, collect independent evidence, analyze gaps, formalize contractual remediation, and continuously monitor performance. Together, these steps protect sensitive data and align partners with your company's standards.

This eight-step process operationalizes the standard TPRM and vendor lifecycle management process:

1. Inventory and categorize: Make a complete list of all your external partners, such as cloud providers, ISPs, marketing agencies, and freelancers. Group them by what they do for your business. Having this overview helps you spot vulnerabilities early, before they become problems. To prevent gaps, cross-reference your records with accounts payable, payroll, and expense reports to capture "shadow" third parties or low-cost SaaS tools that often evade traditional procurement oversight.
   
   
2. Regulatory and framework mapping: Check which laws apply to each partner, such as GDPR, HIPAA, or the EU AI Act. Then link these rules to common security frameworks such as ISO 27001 or the NIST Cybersecurity Framework to keep your assessments consistent.
   
   
3. Inherent risk scoring: Give each partner a risk score before you look at any controls they have in place. Use the formula: Risk Score = Likelihood x Impact. Focus first on partners who handle sensitive data or are vital to your business operations.
   
   
4. Issue tiered questionnaires: Send out questionnaires that match each third party’s risk level. Use simple forms for low-risk services and more detailed ones for high-risk partners who handle sensitive company data.
   
   
5. Evidence collection and third-party due diligence: Back up questionnaire responses with independent evidence, such as SOC 2 Type II reports, ISO certificates, and security test results. Also, use outside risk intelligence to check the third party’s security claims.
   
   
6. Gap analysis and risk reporting: Look for differences between the third party’s security measures and your own requirements. Write a summary report that clearly shows any weaknesses and how they might affect your business. This helps stakeholders understand the residual risk remaining after current controls are applied.
   
   
7. Contractual remediation and risk acceptance: Establish formal action plans to address high-risk issues and incorporate these requirements into your vendor contracts. If some risks can’t be fixed, make sure the responsible person in your company reviews and accepts them based on your organization's risk appetite.
   
   
8. Continuous monitoring and lifecycle management: Use automated tools to keep track of any changes in a third party’s security or compliance. Have a clear exit plan that covers revoking access and ensuring the secure destruction of sensitive data.
   
   

Manual monitoring approaches tend to break down at scale, and Michael Rasmussen, GRC Analyst and "Pundit" at GRC 20/20 Research, diagnoses why: "One of the biggest frustrations in legacy monitoring approaches is the flood of undifferentiated alerts. Teams get overwhelmed by volume, and when everything is urgent, nothing is truly prioritized." That dynamic is what makes automated, intelligent monitoring a requirement rather than a nice-to-have at this stage of the lifecycle.

Third-party risk assessment checklist

This checklist standardizes your evaluation process throughout the third-party lifecycle. Documenting requirements for each phase ensures consistency and audit readiness for all stakeholders. Attention to technical and operational details helps uncover vulnerabilities that superficial reviews may miss.

Common third-party risk areas to evaluate

The most common third-party risk areas to evaluate are cybersecurity, compliance, operational, financial, reputational, strategic, and geographic risk. Assessing partners across these seven domains gives you a complete picture of their stability and protects your operations from hidden threats that go beyond technical security alone.

Risks often compound with each other. For example, if a vendor's finances deteriorate, they may cut staff, which can weaken their cybersecurity and operational resilience. Warning signs, such as a missing SOC 2 Type II report or slow patching, can point to larger underlying issues. Incidents like the 2024 CrowdStrike outage and the 2013 Target breach show that even non-technical or indirect problems can shut down global operations and expose millions of records.

Assess your partners across these seven critical risk domains to protect your operations and data:

• Cybersecurity risk: Check how the vendor handles data, uses encryption, and manages access. Watch out for a history of security problems, weak password rules, or no multi-factor authentication. Hackers often use these weak spots to expand your attack surface management challenges and reach more important targets.
  
  
• Compliance risk: This involves threats to alignment with regulatory standards like GDPR, HIPAA, or the AI Act. Red flags include the absence of a Data Protection Officer (DPO) or failure to comply with industry-specific privacy mandates.
  
  
• Operational risk: Check if the partner can keep services running during problems. Watch for frequent outages, a lack of a tested disaster recovery plan, or reliance on a single sub-contractor for critical tasks.
  
  
• Financial risk: Look for signs that the vendor might go out of business or face financial problems that could disrupt their services. Warning signs include poor credit reports, significant debt, or frequent leadership changes. A vendor’s financial health often affects how much they spend on security.
  
  
• Reputational risk: Bad associations can hurt your customer trust for good. Watch for unfair labor practices, scandals involving company leaders, or a negative market reputation. What your vendor does can affect how people see your brand.
  
  
• Strategic risk: Ensure your business goals stay in sync across long-term contracts. Warning signs include a vendor changing their main business to compete with you or trying to steal your own clients. If your goals don’t match, it can lead to bad decisions that hurt your business.
  
  
• Geographic risk: Consider where the vendor is based and the local data laws. Warning signs include working in unstable countries or places where the government can legally demand access to your business data.
  
  

Third-party risk assessment frameworks

The main third-party risk assessment frameworks are Shared Assessments (SIG), NIST SP 800-161, ISO/IEC 27001, SOC 2 Type II, PCI DSS, HECVAT, and the GDPR framework. Each provides a structured way to evaluate partner security against trusted global standards, ensuring your assessments are consistent, defensible, and aligned with regulatory requirements.

When choosing a framework, consider your regulatory requirements, industry, and the sensitivity of the data you share with partners. NIST SP 800-161, for example, offers a detailed technical guide suited to complex supply chains, while Shared Assessments uses standardized questionnaires to streamline routine reviews. Combining frameworks often strengthens your risk program, especially for organizations operating across multiple jurisdictions or handling regulated data.

You can use these frameworks to organize your assessments and check the security of your third-party partners:

• Shared assessments: This framework uses the Standardized Information Gathering (SIG) questionnaire to collect risk data in 18 different areas. It makes the assessment process easier by offering a single tool for cybersecurity, privacy, and business continuity reviews.
  
  
• NIST SP 800-161: This is a technical framework for managing cybersecurity risks and supply chain risk management. It helps organizations find and reduce risks when buying and maintaining IT products and services.
  
  
• ISO/IEC 27001: This is a global standard for managing information security with a structured set of technical and organizational controls. It asks third parties to demonstrate they are proactive in risk management and are continually working to improve.
  
  
• SOC 2 (Type II): Created by the AICPA, this framework checks a service organization’s controls using the Trust Services Criteria, such as security and privacy. It gives an independent, evidence-based report on how well these controls work over time.
  
  
• PCI DSS: This standard is required for any third party that stores, processes, or sends credit card data. It sets strict security rules for payment gateways and e-commerce platforms to protect sensitive financial information.
  
  
• HECVAT: This tool is designed for higher education and standardizes cloud service assessments to ensure consistent data protection and information security. It makes it easier for colleges to evaluate vendors when handling research and student data.
  
  
• GDPR framework: This framework focuses on the legal duties of data processors when handling the personal data of people in the EU. It requires checks to ensure data-handling, consent, and breach-notification processes comply with the law.
  
  

Best practices for third-party risk assessments

Best practices for third-party risk assessments include moving from one-time checks to continuous monitoring, engaging cross-functional stakeholders, embedding risk requirements into contracts, using trigger-based reassessments, and corroborating self-reported data with independent evidence. Mature programs treat assessments as partnerships and set clear KPIs to track remediation progress across the vendor lifecycle.

To make your program stronger and easier to grow, try these advanced strategies:

• Cross-reference accounts payable: Each year, check your accounts payable records against your approved vendor list. This helps you find any third parties or SaaS tools that were bought without proper security checks.
  
  
• Assess at the relationship and product levels: Review both the vendor as a whole and the specific product or service they provide. Even a trusted vendor might offer a tool that is not secure or improperly configured.
  
  
• Frame the assessment as a partnership: Treat it as a team effort to improve security for both parties, not just a strict audit. Being open often leads to better answers and faster responses.
  
  
• Define success metrics: Set clear KPIs to track how well your risk assessments work. For example, measure the average time required for risk remediation after a major issue is found during your checks.
  
  
• Mandate adequate controls: Don’t require every third party to use the same security tools as you. Instead, make sure they have the right protections to address the risks they pose.
  
  
• Formalize an exit strategy: Add "right to be forgotten" and data deletion terms to contracts. This ensures sensitive data is properly erased when the partnership ends.
  
  
• Embed risk management into contracts: Make sure corrective action plans (CAPs) are legally binding and include clear penalties if a vendor does not comply or fails to report a breach on time.
  
  
• Engage cross-functional stakeholders: Bring in people from legal, procurement, and other key teams when reviewing vendors. This helps ensure risk decisions align with your business goals.
  
  
• Utilize trigger-based reassessments: Don’t just rely on annual reviews. Start a new assessment right away if a third party is involved in a merger or acquisition, or if a major security issue arises.
  
  
• Corroborate self-reported data: For high-risk vendors, don’t just trust their answers on questionnaires. Always check their claims with independent SOC 2 Type II reports, penetration testing results, or outside threat intelligence.
  
  

Third-party risk assessment report samples

Third-party risk assessments result in a summary report of their findings. The example reports below were generated by Strike Graph’s Trust Chain solution for TPRM. Unlike static templates, these report samples illustrate automated, AI-verified evidence validation for different types of vendors.

Example of a third-party risk assessment interim summary report

This example shows an interim summary report for a fictional company called Delta Corp. Note that it flags items for review.

Example of a third-party risk assessment final summary report

This example shows a completed summary report for a fictional company called Luxer, Inc. Note that it reflects completed verification and a "Satisfied" status.

Managing vendor profiles gives you complete control over your third-party relationships. You can assign a custom 1-to-10 score to each vendor; while many use this to track risk, it's entirely adaptable to your needs. The assessment status window is particularly helpful for getting a quick snapshot of a vendor's standing. At a glance, you can easily spot missing evidence, check approval statuses, and see exactly what needs fixing.

Example of a third-party risk assessment dashboard

This third-party overview dashboard example from Strike Graph provides a high-level snapshot by organizing vendors based on their current progress, like fully compliant, in progress, or not started.

Example of a TPRM evidence request library for risk assessments

This screen from Strike Graph’s Trust Chain TPRM product shows how users can create, upload, or modify common evidence requests and target specific evidence artifacts to the appropriate vendors.

Templates for third-party risk assessment

The templates below give you a working structure for running assessments and tracking their progress. Each one is tiered for standard and higher-risk vendors, so the depth of your review matches the actual exposure a partner presents. You can use them directly or adapt them to your own regulatory requirements.

Third-party risk assessment process tracking template

Download this third-party risk assessment process tracking template set.

This template set turns the eight-step process into a task list you can assign and monitor. It includes two templates, one on each tab. The standard vendor sheet keeps routine engagements moving with 25 tasks. The higher-risk sheet expands to 51 tasks, adding sub-processor mapping and trigger-based reviews. Each task carries an owner, target date, status, and evidence reference.

Third-party risk assessment questionnaire template set

Download this third-party risk assessment questionnaire template.

This template set contains questionnaires to send to either a standard or higher-risk vendor. The standard sheet covers 36 questions across governance, access, and data protection. The higher-risk sheet runs to 83 questions, reaching into privileged access, supply chain, and geopolitical exposure. Both give you a structured, comparable record of every vendor's controls.

Third-party risk assessment summary report templates

Download this third-party risk assessment summary report template for lower-risk vendors. Also included is a filled-in example.

Use this template to summarize the assessment findings for a lower-risk vendor. This template includes a blank tab and a worked example for a fictional company called Luxer Inc. It includes eight sections, including the overall risk rating, evidence findings, remediation plan, and sign-off.

Download this third-party risk assessment summary report template for a high-risk vendor. Also included is a filled in example. 

Use this summary report template to outline the assessment findings for a high-risk vendor. This template also includes a blank tab and worked example for a fictional company called Delta Corp. It also includes nine sections, and will typically require more depth than a low-risk vendor would.

Tools for third-party risk assessment

Third-party risk assessment tools include end-to-end TPRM platforms, security ratings services, GRC modules, questionnaire automation, and continuous monitoring systems. Mature programs typically use multiple tools, while AI-native platforms are consolidating these functions by unifying evidence validation, multi-framework mapping, and real-time monitoring throughout the vendor lifecycle.

Strong risk management strategies use specialized technology to turn raw data into useful insights:

• Agentic questionnaire and remediation workflows: AI compliance tools that automatically fill out complex security questionnaires with accurate, detailed answers based on your existing security controls. These assistants can also interpret API documentation to generate secure integration configurations, reducing manual setup time while maintaining high standards.
  
  
• Multi-framework control mapping: Advanced systems can use a single piece of evidence to meet multiple global standards simultaneously, such as ISO 27001, HIPAA, and GDPR. This smart mapping lets you expand compliance programs across locations or products without having to enter the same data for each new regulation.
  
  
• Continuous monitoring engines: Automated systems go beyond one-time reviews by using custom schedules to request updated evidence from your partners. This ongoing monitoring gives you real-time visibility into your supply chain and ensures you get immediate alerts about changes in security status, so you don't have to wait for annual reviews.
  
  The value is not simply more information; it is better-filtered information. As Rasmussen states: "That is where AI becomes powerful. It reduces alert fatigue by helping teams focus on the few issues that have real business, compliance, resilience, or security significance."
  
  
• Automated evidence validation: AI-powered validation engines review third-party reports, like SOC 2 audits and penetration tests, to check if the controls meet your requirements. This technology looks for concrete evidence of compliance rather than just summarizing text, reducing manual review and improving consistency.
  
  
• Relational data modeling: This approach uses a graph-based data model to link third-party relationships, risks, and controls throughout your organization. By mapping these connections, the software helps you see how a single vulnerability at one partner can affect your overall supply chain security.
  
  

How to streamline third-party risk assessment

Using manual spreadsheets and email tracking often slows down decision-making. Switching to an AI-native risk management platform helps your team automate evidence collection and validation, even when dealing with many complex external partners.

Strike Graph’s Trust Chain, its AI-native TPRM product, offers a secure space where third-party risk management and internal compliance programs use the same data model. By bringing these functions together, you avoid the hassle of juggling different tools and make sure vendor evidence links directly to your existing frameworks.

This setup brings your team several practical benefits:

• Agentic document review: Verify AI automatically reads partner documents and pulls out control details, so you don’t have to do it by hand. It also flags missing information and keeps people involved to ensure accountability during audits.
  
  
• Proprietary compliance models: The platform uses models trained just for compliance work, so evidence validation is highly accurate. This focus helps avoid mistakes that can happen with general-purpose AI systems.
  
  
• End-to-end source traceability: Each risk finding connects straight to the evidence behind it, so risk officers can trace scores back to exact parts of documents. This creates a clear audit trail for regulators and stakeholders.
  
  
• Continuous, real-time monitoring: The system connects to thousands of data sources to keep watch on third-party security at all times. Risk profiles update right away using technical data and news, so you don’t have to wait for yearly reviews.
  
  
• Privacy-first data handling: Sensitive partner information is kept separate and encrypted, so your data is never used to train outside AI models. This protection is essential for organizations that share confidential vendor data on a compliance platform.
  
  

To learn more about Strike Graph, chat with our compliance experts today. Book a consultative meeting today.