Folio 7Framework · lifecycle and rules

The TPRM framework: the lifecycle, and the rules behind it

What a third-party risk management program has to do, stage by stage, in the words of the regulators who ask for it, with every rule linked to its official text and the software approaches that cover each stage.

In brief

US banking regulators’ 2023 interagency guidance names five life-cycle stages: planning; due diligence and third-party selection; contract negotiation; ongoing monitoring; termination. Over them sit three governance duties: oversight and accountability; independent reviews; documentation and reporting. DORA, NIS2, NYDFS Part 500, PCI DSS, HIPAA and the UK and Australian rules ask for the same cycle in their own words. A TPRM framework is that cycle, plus a policy, a tiering rule and a register.

The five stages of the lifecycle

Stage names quoted from the 2023 interagency guidance. What each involves, in our words, and which software approaches cover it.

Planning
Decide whether the activity should be outsourced at all: the risks, the benefits, the cost, how critical it is, and what you would do if the third party failed.
Assessment workflowGRC suite module
Due Diligence and Third-Party Selection
Check the candidates before signing: security, finances, legal and regulatory history, subcontractors, resilience. Depth follows the risk of the activity.
Assessment workflowSecurity ratingsAI-first assessment
Contract Negotiation
Write what was learned into the contract: performance standards, security and notification duties, audit and information rights, subcontracting, data return, exit.
GRC suite moduleAssessment workflow
Ongoing Monitoring
Watch the relationship for as long as it lasts: performance, incidents, ratings, financial health, changes in ownership, and periodic reassessment on the risk’s schedule.
Security ratingsAssessment workflowAI-first assessment
Termination
End it cleanly: move the activity, return or destroy data, remove access, and keep the records. Plan this before signing.
Assessment workflowGRC suite module

Governance across all five: Oversight and Accountability · Independent Reviews · Documentation and Reporting. The guidance is scaled: more rigour for relationships that support critical activities, less for low-risk ones. It is supervisory guidance, not a rule, and it replaced each agency’s earlier guidance (the OCC rescinded Bulletins 2013-29 and 2020-10). Federal Register text.

The rules, side by side: 17

Each rule or framework, who it applies to, its key dates, and what it asks about third parties, from its official text.

United States

United States: rules that require third-party risk management
Rule	Applies to	Dates	What it asks about third parties
Interagency Guidance on Third-Party Relationships: Risk ManagementBoard of Governors of the Federal Reserve System, Federal Deposit Insurance Corporation	All banking organizations supervised by the three agencies; OCC Bulletin 2023-17 says it 'applies to all banks with third-party relationships'.	final: 2023-06-06; federal register: 88 FR 37920, Friday 2023-06-09	Supervisory guidance (not a rule) setting sound risk-management principles for every stage of a third-party relationship, scaled to the bank's risk, complexity and size and to the nature of the relationship. It replaces each agency's earlier general guidance; the OCC rescinded Bulletins 2013-29 and 2020-10.
Third-Party Risk Management: A Guide for Community BanksBoard of Governors of the Federal Reserve System, FDIC, OCC	Written for community banks; the OCC says use is voluntary and relevance depends on the bank's size, complexity and risk profile.	published: May 2024	Nothing new. The guide states that supervisory guidance 'does not have the force and effect of law and does not impose any new requirements on banks'. It offers considerations, resources and examples for each stage of the 2023 guidance's life cycle.
23 NYCRR Part 500 , section 500.11 Third-party service provider security policyNew York State Department of Financial Services	Covered entities: any person operating under, or required to operate under, a licence, registration, charter or similar authorization under the NY Banking Law, Insurance Law or Financial Services Law.	part 500 promulgated: 2017-03-01; section 500 11 original transition: Two years from the Part's effective date to comply with 500.11)	Each covered entity must keep written, risk-assessment-based policies and procedures to secure systems and nonpublic information that third-party service providers can access or hold. They must cover TPSP identification and risk assessment, minimum cybersecurity practices, due diligence, and periodic assessment. They must also include due-diligence or contractual guidelines on access controls including MFA, encryption, notice of cybersecurity events, and representations and warranties.
Regulation S-P amendmentsU.S. Securities and Exchange Commission	Broker-dealers (including funding portals), investment companies, registered investment advisers and transfer agents ('covered institutions').	adopted: 2024-05-15; announced 2024-05-16	A covered institution's incident response program must include written policies and procedures 'reasonably designed to require oversight, including through due diligence and monitoring, of service providers'. Service providers must protect customer information and notify the institution 'as soon as possible, but no later than 72 hours' after becoming aware of a breach of a customer information system they maintain.
HIPAA Privacy and Security Rules: business associate contracts, 45 CFR 164.502 , 164.504 and 164.308U.S. Department of Health and Human Services	HIPAA covered entities and their business associates, including subcontractors.		A covered entity may let a business associate handle protected health information only after obtaining 'satisfactory assurance' that it will safeguard the information, documented in a written contract that meets 164.504(e).
PCI DSS v4.0.1, Requirement 12.8 and Requirement 12.9PCI Security Standards Council	Entities assessed against PCI DSS that use third-party service providers (TPSPs). Requirement 12.9 applies only to service providers.	v4 0 1 published: 2024-06-11 (limited revision; no new or deleted requirements)	Per PCI SSC FAQ 1312, customers must manage and oversee all their TPSP relationships and monitor TPSPs' PCI DSS compliance status under Requirement 12.8. That includes due diligence, appropriate agreements, identifying which requirements fall to the customer and which to the TPSP, and monitoring compliance status at least annually. Requirement 12.8 'does not specify that the customer's TPSPs must be PCI DSS compliant'.

European Union

European Union: rules that require third-party risk management
Rule	Applies to	Dates	What it asks about third parties
Regulation 2022/2554European Parliament and Council of the EU	Financial entities in Art. 2(1)(a)-(t): 20 types, including credit institutions, payment and e-money institutions, investment firms, crypto-asset service providers, CSDs, CCPs, trading venues, fund managers, insurers and intermediaries, IORPs, credit rating agencies and crowdfunding providers. Art. 2(1)(u) brings in ICT third-party service providers.	adopted: 2022-12-14; official journal: OJ L 333, 2022-12-27	Financial entities must manage ICT third-party risk as part of their ICT risk management framework (Art. 28(1)). They must keep a register of information on all contractual arrangements for ICT services, at entity, sub-consolidated and consolidated level (Art. 28(3)), and report at least yearly to competent authorities on new arrangements. Before contracting they must assess ICT concentration risk (Art. 29), and contracts must contain mandatory provisions set out in writing (Art. 30).
Directive 2022/2555European Parliament and Council of the EU	Essential and important entities as defined in Art. 3, by reference to the sectors in Annexes I and II and size thresholds. Applies through national transposing law.	adopted: 2022-12-14; transposition deadline: 2024-10-17: Member States to adopt and publish measures by 17 October 2024)	Art. 21(2)(d) requires cybersecurity risk-management measures that include 'supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers'. Under Art. 21(3), entities must take into account each direct supplier's specific vulnerabilities and the quality of its products and cybersecurity practices, including secure development.
EBA Guidelines on outsourcing arrangementsEuropean Banking Authority	Institutions (credit institutions and investment firms under CRD) and payment and electronic money institutions.	final report: 2019-02-25; press release: 2019-03-04	A governance framework for outsourcing, with criteria for whether outsourced functions are critical or important. Firms must keep an updated register of information on all outsourcing arrangements (para 52) and meet requirements on due diligence, contracts, sub-outsourcing, monitoring and exit strategies. The guidelines repealed the 2006 CEBS outsourcing guidelines and the 2017 EBA cloud recommendations.
EBA Guidelines on the sound management of third-party risk related to non-ICT servicesEuropean Banking Authority	Firms in the EBA's remit (legal basis Art. 74 CRD; PSD2, IFD, MiFID II and MiCAR also taken into account).	final published: 2026-09-18; status: Final, awaiting translation into EU official languages	Focuses on third-party arrangements supporting critical or important functions. Covers the full lifecycle: 'risk assessment and due diligence, contracting, subcontracting, monitoring, documentation and exit strategies'. Aligned with DORA and the BCBS principles.

United Kingdom and Australia

United Kingdom and Australia: rules that require third-party risk management
Rule	Applies to	Dates	What it asks about third parties
PRA Supervisory Statement SS2/21 'Outsourcing and third party risk management'Prudential Regulation Authority	UK banks, building societies and PRA-designated investment firms; insurers and reinsurers in scope of Solvency II, including Lloyd's and managing agents; UK branches of overseas banks and insurers. Some parts apply to credit unions and non-directive firms.	first published: 2021-03-29; effective: 2022-03-31	Sets the PRA's expectations for outsourcing and third-party arrangements: materiality and risk assessment, due diligence, minimum content of written agreements for material outsourcing, data security, access, audit and information rights, sub-outsourcing, and business continuity and exit plans. It implements the EBA outsourcing guidelines for banks.
Prudential Standard CPS 230 Operational Risk ManagementAustralian Prudential Regulation Authority	APRA-regulated entities: banks/ADIs, general and life insurers, private health insurers and superannuation (RSE) licensees. Also applies on a group basis.	finalised: 2023-07-17; commenced: 2025-07-01	Entities must keep a service provider management policy and a register of material service providers, submitted to APRA annually. Material arrangements need a formal, legally binding agreement. APRA must be notified within 20 business days of entering into or materially changing an agreement for a service relied on for a critical operation, and before any material offshoring.

International standards and principles

International standards and principles: rules that require third-party risk management
Rule	Applies to	Dates	What it asks about third parties
Principles for the sound management of third-party riskBasel Committee on Banking Supervision	Banks and supervisors (international baseline).	consultative: 2024-07-09; final guidelines: 2025-12-10	Sets 'a common baseline for banks and supervisors in managing risks associated with third-party providers', broadening the traditional concept of outsourcing to cover a wider range of third-party arrangements.
NIST Cybersecurity Framework 2.0 , category Cybersecurity Supply Chain Risk ManagementNIST	Voluntary; any organization 'regardless of its size, sector, or maturity'.	published: 2024-02-26	GV.SC: 'Cyber supply chain risk management processes are identified, established, managed, monitored, and improved by organizational stakeholders'. The CSF does not prescribe how outcomes are achieved.
NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and OrganizationsNational Institute of Standards and Technology	Guidance for organizations; NIST's abstract addresses organizations at all levels. Voluntary outside contexts where federal policy mandates it.	published: May 2022; update: Rev. 1 Update 1: 'includes updates as of 11-01-2024'	Guidance on identifying, assessing and mitigating cybersecurity risks throughout the supply chain at all organizational levels, including C-SCRM strategy implementation plans, policies, plans and risk assessments for products and services.
ISO/IEC 27036 Cybersecurity - Supplier relationshipsISO/IEC JTC 1/SC 27	Any organization acquiring or supplying products and services; 27036-2 'is applicable to all organizations, regardless of type, size and nature'.	27036-1: 2021; 27036-2: 2022-06 (Requirements	27036-2 'specifies fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships'.
Shared Assessments Third-Party Risk Management FrameworkShared Assessments	Industry best-practice guidance, not a regulation.		Guidance for building and maturing a TPRM program, organised into 'Fundamentals' and 'Processes' modules. Public status: the Fundamentals modules are marked 'Register to Download'; the Processes modules (Periodic and Continuous Monitoring; Contracts; Due Diligence) link to 'Explore Membership'. So it is not freely public.

Three rules that ask for a register

The core record of a TPRM program is the inventory. Three of the rules above require one by name.

Registers required by rule
Rule	The register it asks for
DORA, Art. 28(3)	A register of information on all contractual arrangements for ICT services, at entity, sub-consolidated and consolidated level, reported to the supervisor.
EBA outsourcing guidelines, para 52	An updated register of information on all outsourcing arrangements.
APRA CPS 230	A register of material service providers, submitted to APRA every year.

DORA’s critical ICT third-party providers. On 2025-11-18 the European Supervisory Authorities designated the first 19 providers for direct EU oversight: Accenture plc, Amazon web Services EMEA Sarl, Bloomberg L.P., Capgemini SE, Colt Technology Services, Deutsche Telekom AG, Equinix (EMEA) B.V., Fidelity National Information Services, Inc., Google Cloud EMEA Limited, International Business Machine Corporation, InterXion HeadQuarters B.V., Kyndryl Inc., LSEG Data and Risk Limited, Microsoft Ireland Operations Limited, NTT DATA Inc., Oracle Nederland B.V., Orange SA, SAP SE, Tata Consultancy Services Limited. The list is updated every year.

The standards a program can be built on

NIST CSF 2.0: Cybersecurity Supply Chain Risk Management (GV.SC)

GV.SC-01: A cybersecurity supply chain risk management program, strategy, objectives, policies, and processes are established and agreed to by organizational stakeholders
GV.SC-02: Cybersecurity roles and responsibilities for suppliers, customers, and partners are established, communicated, and coordinated internally and externally
GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes
GV.SC-04: Suppliers are known and prioritized by criticality
GV.SC-05: Requirements to address cybersecurity risks in supply chains are established, prioritized, and integrated into contracts and other types of agreements with suppliers and other relevant third parties
GV.SC-06: Planning and due diligence are performed to reduce risks before entering into formal supplier or other third-party relationships
GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship
GV.SC-08: Relevant suppliers and other third parties are included in incident planning, response, and recovery activities
GV.SC-09: Supply chain security practices are integrated into cybersecurity and enterprise risk management programs, and their performance is monitored throughout the technology product and service life cycle
GV.SC-10: Cybersecurity supply chain risk management plans include provisions for activities that occur after the conclusion of a partnership or service agreement

ISO/IEC 27001:2022 supplier controls

5.19: Information Security in Supplier Relationships
5.20: Addressing Information Security Within Supplier Agreements
5.21: Managing Information Security in the ICT Supply Chain
5.22: Monitoring, Review and Change Management of Supplier Services
5.23: Information Security for Use of Cloud Services

ISO/IEC 27036: supplier relationships

27036-1:2021: Introductory part: overview of guidance for securing information and information systems in supplier relationships, and the concepts detailed in the other parts, from both acquirer and supplier perspectives.
27036-2:2022: Fundamental information security requirements for defining, implementing, operating, monitoring, reviewing, maintaining and improving supplier and acquirer relationships, for any procurement and supply of products and services (manufacturing, business-process and knowledge-process procurement, software/hardware components, build-operate-transfer, cloud services).
27036-3:2023: Guidance for acquirers and suppliers on visibility into, and management of, information security risks from dispersed, multi-layered hardware/software/services supply chains, and on integrating security into ISO/IEC/IEEE 15288 and 12207 life cycle processes. Excludes business continuity (see ISO/IEC 27031).
27036-4:2016: Guidance for cloud service customers and providers on visibility into and management of information security risks of using cloud services, and on risks specific to acquiring or providing cloud services. Excludes business continuity and CSP implementation guidance (see ISO/IEC 27002 and 27017).

Fourth parties

Your third parties have suppliers too, and a failure there reaches you. The rules handle it differently: NIS2 asks entities to take account of each direct supplier’s practices; DORA puts conditions on subcontracting critical functions; the EBA guidelines and the PRA’s SS2/21 have sections on sub-outsourcing; and the SIG questionnaire gives “Nth Party Management” its own risk domain. In practice, programs ask critical vendors for their subcontractor lists, write approval rights into contracts, and use outside-in tools to see which services their vendors depend on.

5 products in the register mention fourth- or nth-party coverage on their own pages; their entries say how.

Questions

What is a third-party risk management framework?

The policy, roles and steps an organisation uses to manage the risks its third parties bring: an inventory, a way to tier each relationship by risk, due diligence before signing, contract terms, monitoring while it lasts, and a clean exit. US banking regulators describe it as a life cycle with five stages under three governance duties; other rules use their own words for the same cycle.

What are the stages of the TPRM lifecycle?

The 2023 interagency guidance from the Federal Reserve, FDIC and OCC names five: Planning; Due Diligence and Third-Party Selection; Contract Negotiation; Ongoing Monitoring; Termination. Over all five sit three governance duties: Oversight and Accountability; Independent Reviews; Documentation and Reporting.

What does the OCC require for third-party risk management?

The OCC, with the Federal Reserve and FDIC, issued the Interagency Guidance on Third-Party Relationships: Risk Management in June 2023 (OCC Bulletin 2023-17), replacing its earlier bulletins. It is supervisory guidance, not a rule: it sets principles for each stage of the life cycle, scaled to the bank’s size and complexity and to how critical the activity is. In May 2024 the agencies added a voluntary guide for community banks.

What is fourth-party risk?

The risk from your third parties’ own suppliers and subcontractors: the cloud host your payroll provider runs on, for example. NIS2 asks entities to consider their direct suppliers’ practices; DORA, the EBA guidelines and the UK PRA’s SS2/21 set rules for subcontracting and sub-outsourcing; the SIG questionnaire has a whole domain for it, “Nth Party Management”.

Which regulators require a register of third parties?

Three of the rules on this page ask for one by name: DORA’s register of information on ICT contracts, the EBA’s register of outsourcing arrangements, and APRA’s register of material service providers. DORA’s is the most detailed and is reported to supervisors.

Which of these rules do you answer to?

Tell us, and how many third parties you manage. We reply with the products in this register that produce what those rules ask for. We only pass your details to a vendor if you ask us to.

Get a shortlist

Sources for this page

Interagency Guidance on Third-Party Relationships: Risk Management, 88 FR 37920 (June 9, 2023) — The five life-cycle stages and three governance sections, quoted verbatim.
Third-Party Risk Management: A Guide for Community Banks — Board of Governors of the Federal Reserve System, FDIC, OCC: what it requires of third parties.
Regulation 2022/2554 — European Parliament and Council of the EU: what it requires of third parties.
Directive 2022/2555 — European Parliament and Council of the EU: what it requires of third parties.
23 NYCRR Part 500 , section 500.11 Third-party service provider security policy — New York State Department of Financial Services: what it requires of third parties.
NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations — National Institute of Standards and Technology: what it requires of third parties.
NIST Cybersecurity Framework 2.0 , category Cybersecurity Supply Chain Risk Management — NIST: what it requires of third parties.
Regulation S-P amendments — U.S. Securities and Exchange Commission: what it requires of third parties.
PCI DSS v4.0.1, Requirement 12.8 and Requirement 12.9 — PCI Security Standards Council: what it requires of third parties.
HIPAA Privacy and Security Rules: business associate contracts, 45 CFR 164.502 , 164.504 and 164.308 — U.S. Department of Health and Human Services: what it requires of third parties.
EBA Guidelines on outsourcing arrangements — European Banking Authority: what it requires of third parties.
EBA Guidelines on the sound management of third-party risk related to non-ICT services — European Banking Authority: what it requires of third parties.
PRA Supervisory Statement SS2/21 'Outsourcing and third party risk management' — Prudential Regulation Authority: what it requires of third parties.
Prudential Standard CPS 230 Operational Risk Management — Australian Prudential Regulation Authority: what it requires of third parties.
ISO/IEC 27036 Cybersecurity - Supplier relationships — ISO/IEC JTC 1/SC 27: what it requires of third parties.
Shared Assessments Third-Party Risk Management Framework — Shared Assessments: what it requires of third parties.
Principles for the sound management of third-party risk — Basel Committee on Banking Supervision: what it requires of third parties.
NIST CSF 2.0 (CSWP 29) — The GV.SC subcategories.

Each product’s own sources are linked from its entry in the register. How products are chosen and ordered, and how to correct an entry: methodology.

Cite this page

Third-Party Risk Management Software. “The TPRM framework: the lifecycle and the rules behind it.” Updated November 8, 2026. https://thirdpartyriskmanagementsoftware.com/tprm-framework/