Third-party cyber risk
How your organisation really governs supplier cyber risk.
Third-party risk is now a top priority for boards. Yet most organisations manage it at a conceptual level or through large-scale tick-box questionnaires, creating a dangerous false sense of security.
A standard TPRM process that signs off a supplier based on paper policies or an ISO certificate tells you that a process was followed. It does not tell you where you actually stand. That gap is rarely visible until a major cyber breach forces it into the open.
We focus specifically on your business-critical suppliers: identifying your real risk exposure, tiering key dependencies beneath them where needed, and assessing the true impact on business continuity.
Our cyber work covers regulatory and governance advice; not penetration testing, technical security assessment, or managed security services.
What it covers
- How supplier cyber risk is owned, assessed and overseen
- Whether your current TPRM process gives you a genuine picture of supplier risk, or a false sense of security
- Supply chain governance across your business-critical suppliers
- Supplier tiering and the likely impact on business continuity
- Readiness against the supplier obligations in NIS2, DORA and the UK Cyber Security and Resilience Bill
Tiers & delivery
| Tier | What it involves | Delivery & Output |
|---|---|---|
| Snapshot | Rapid desk-based review of your TPRM framework, critical supplier register, and core governance documents. | High-level summary of your current supplier governance posture and key quick wins. |
| Assessment | Document review plus structured interviews examining how supplier tiering, escalation, and board reporting work in practice. | Detailed findings report on real-world governance effectiveness and prioritised recommendations. |
| Extended review | Deep-dive across supplier governance, critical sub-tiering, business continuity impact, and regulatory alignment (including NIS2 and DORA). | Full executive report, continuity risk matrix, and regulatory readiness roadmap for board or regulator review. |
Third-party cyber risk can be commissioned on its own, or combined with KYData Cyber Governance and board workshops and tabletops into a broader cyber governance programme.