Skip to content

Bearlink · Third-party risk

TPRM: what third-party risk management is and how to structure it

By Updated on

TPRM, or third-party risk management, is the practice of assessing and monitoring the risks that suppliers, subcontractors and partners pose to an organisation. It covers document compliance, regulatory due diligence, financial health and, increasingly, cybersecurity. Bearlink implements this full cycle on a sovereign platform.

Structure my TPRM
  • Full third-party lifecycle
  • Compliance and cybersecurity
  • Developed in France

Why is third-party risk becoming a priority?

According to Verizon’s 2026 Data Breach Investigations Report, published on 19 May 2026, 48% of data breaches now involve a third party, a share up 60% in a year. A failing subcontractor, a compromised supplier or an undeclared partner is enough to open the door. Regulation has drawn the conclusion and now requires these third parties to be assessed and monitored. Managing third-party risk by hand, in spreadsheets, no longer holds up.

What does a complete TPRM cover?

A complete TPRM covers several dimensions of risk: legal and administrative, financial, ethics and anti-corruption, environmental and social, data protection, and cybersecurity. For a long time, this last dimension remained the weakest; Bearlink covers it with a natively produced cyber rating, presented on the Bearlink page.

Third-party risk

  • Legal and administrative
  • Financial
  • Ethics and anti-corruption
  • Environmental and social
  • Personal data
  • Cybersecurity
A complete TPRM covers six dimensions of risk: legal and administrative, financial, ethics and anti-corruption, environmental and social, personal data, and cybersecurity.

What are the stages of the supplier lifecycle?

  1. Onboard

    Create the third party’s record and gather the basic information.

  2. Assess

    Collect documents, launch due diligence, rate the risks.

  3. Contract

    Build compliance and security requirements into the contract.

  4. Monitor

    Track expiry dates, the cyber rating and alerts continuously.

  5. Exit

    Controlled offboarding and archiving with evidential value.

The supplier lifecycle follows five stages: onboard, assess, contract, monitor, exit.

The documentary and regulatory foundation

The core of a TPRM is still collecting and verifying documents: URSSAF social security certificate, company registration, insurance, tax compliance, tracked until expiry. On top of this comes due diligence: questionnaires on the French anti-corruption law (Sapin II), the French corporate duty of vigilance law, CSR, GDPR, NIS2 and DORA , sanctions screening, IBAN checks against fraud.

See beyond your direct suppliers

A major risk hides behind your direct suppliers: the same critical provider may be a subcontractor to several of them. Mapping this Nth-tier subcontracting reveals concentration risks, where a single failure affects several of your chains.

Critical provider
  • Direct suppliers
  • Nth-tier subcontracting
  • Concentration risk
The same critical provider may be a subcontractor to several of your direct suppliers: a single failure affects several of your chains.

What do NIS2 and DORA require regarding your suppliers?

NIS2 includes supply chain security, including relationships with direct suppliers, among the expected risk-management measures (Article 21). DORA governs ICT third-party risk and requires a register of information on the contractual arrangements in place (Article 28). TPRM provides the tooling for these requirements.

Sources and references

  1. Verizon, 2026 Data Breach Investigations Report (19 May 2026): a third party involved in 48% of breaches, up 60% in a year
  2. Directive (EU) 2022/2555 (NIS2), Article 21, supply chain security, EUR-Lex
  3. Regulation (EU) 2022/2554 (DORA), Chapter V, managing of ICT third-party risk, EUR-Lex
  4. Regulation (EU) 2016/679 (GDPR), Article 28, processors, EUR-Lex
  5. Law No. 2016-1691 of 9 December 2016 on transparency, the fight against corruption and the modernisation of economic life (Sapin II, French anti-corruption law), Légifrance (in French)
  6. Law No. 2017-399 of 27 March 2017 on the duty of vigilance of parent companies and ordering companies (French corporate duty of vigilance law), Légifrance (in French)

Sources consulted on . Report an error: contact+site@bearops.fr

Frequently asked questions

What is TPRM?

TPRM (third-party risk management) is the management of risks linked to third parties: suppliers, subcontractors, partners. It covers document compliance, regulatory due diligence, financial health, ethics, the environment and cybersecurity, across the whole lifecycle of the third party.

What is the difference between TPRM and supplier management?

Supplier management aims at procurement efficiency. TPRM aims at controlling risk: it assesses and monitors the compliance, soundness and security of third parties. The two are complementary and often share the same data.

Is TPRM a regulatory obligation?

No text requires “a TPRM” as such, but several obligations require its components: the French vigilance obligation, Sapin II, the duty of vigilance, NIS2, DORA, GDPR. A TPRM provides the tooling to meet these obligations and keeps a record of the evidence.

What is concentration risk?

It is the risk that the same critical provider ends up as a subcontractor to several of your suppliers. Its failure would then affect several chains at once. Mapping it means looking beyond direct suppliers, down to Nth-tier subcontracting.

Structure your third-party risk management

A scoping discussion positions your TPRM approach and shows, on a sample of your suppliers, what Bearlink brings to compliance and cyber.

Structure my TPRM