Process for assessing, monitoring, and contracting security risk introduced by third parties.
Third-Party Risk Management (TPRM) is the lifecycle process for evaluating and monitoring security, privacy, and operational risk introduced by vendors. Typical artefacts: tiering matrix, due-diligence questionnaire (SIG, CAIQ), SOC 2/ISO 27001 review, ongoing monitoring, exit plan.
Run a free ComplianceIQ audit against SOC 2 and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.