Third-party risk: a practical guide for mid-market companies

Third-party risk is the chance that a supplier you depend on causes you a security incident, a data problem, a gap in your finance operations or a contract you cannot get out of. Managing it comes down to five steps: list your suppliers, rank them by what they can reach, check the ones that matter most, write the protections into contracts, and plan how you would leave each critical supplier.

This guide covers those steps for mid-market companies, across security, data, the back office and contracts. Facts below were checked against Verizon, EU law and OSFI on October 30, 2026.

This guide is general information, not legal advice. Have contract terms reviewed by your own lawyer.

Disclosure: OPS provides managed detection and response, sovereign data work and outsourced bookkeeping through Business as a Service, and earns fees from that work. That makes OPS one of your third parties too, so the same questions apply to us.

Why it is growing

Verizon's 2025 Data Breach Investigations Report found that third-party involvement in breaches doubled, from about 15% to 30%. The report analysed more than 22,000 security incidents, including 12,195 confirmed breaches.

Our archive covers how this plays out: attackers reached Target through an HVAC contractor (the Target lesson), one software vendor became the route to hundreds of victims (Kaseya), and a trusted software update carried an attack (SolarWinds).

Regulators have noticed. In the EU, the Digital Operational Resilience Act (DORA) has applied to financial entities since January 17, 2025, and requires a register of information on their ICT third-party providers. In Canada, OSFI Guideline B-10 on third-party risk management has applied to federally regulated financial institutions since May 1, 2024. In the UK, the proposed Cyber Security and Resilience Bill would bring managed service providers into scope; see our guide to the Bill. Even if none of these apply to you, your customers in those sectors may ask you the same questions.

Four kinds of exposure

Scroll to read all columns.

Step 1. List your suppliers

Start from what you pay. Your ERP's supplier list and recent payments show who you actually use, including tools bought on company cards. For each supplier, record the owner inside your company, what it does, what systems and data it can reach, and where that data is held.

Step 2. Rank them by what they can reach

Put each supplier in a tier. A simple version:

• Critical. Holds sensitive data, has privileged access, or runs a process you cannot stop for a week.
• Important. Holds some data or supports a key process, but you could work around it for a while.
• Low. No meaningful access, and easy to replace.

Spend your checking effort on the critical tier.

Step 3. Check the suppliers that matter

For critical suppliers, ask for evidence rather than a questionnaire alone:

• Security. Independent reports or certifications, such as a SOC 2 report or ISO 27001 certificate, and what they cover.
• Access. Who on their side can reach your systems, how sign-in is protected, and how access is removed when people leave.
• Data. Where your data is stored and processed, which subcontractors touch it, and whether it is used to train AI. See Third-party AI risk assessment.
• Financial health. Whether the supplier can keep delivering. See When your outsourcing vendor fails financially.
• Back office controls. For anyone who handles your finances, who can change supplier bank details and release payments. Our payment fraud controls guide covers this.

Step 4. Write it into the contract

Topics to raise with your lawyer for critical suppliers:

• How fast they must tell you about a security incident, and what they must share.
• Which subcontractors they use, and how they tell you about changes.
• Where your data may be stored and processed.
• Your right to audit or receive evidence, in a form that works in practice. See Audit rights in cloud contracts.
• Who owns your data, how you get it back and in what format. See Who owns your data in an outsourcing contract.
• Help with handover if the contract ends.

Step 5. Plan the exit

For each critical supplier, write down how you would leave: where your data goes, who takes over the work, how long it takes and what it costs. Test the data export before you need it. If you use cloud services in the EU, the EU Data Act sets switching rules; our guide to data sovereignty covers them.

Keep it running

• Review critical suppliers at least once a year, and when a contract renews.
• Add new suppliers to the list before the first payment, not after.
• Remove supplier access as soon as work ends.
• Watch for incidents at your suppliers in the news and in their notices to you.

Common questions

What is third-party risk?

The risk that a supplier, contractor or service provider causes you harm, through a security incident, misuse of your data, a failed process or contract terms that trap you.

Do small and mid-market companies need a third-party risk program?

Yes, sized to fit. A supplier list, a simple tiering and a yearly check of critical suppliers covers most of the value.

Is a security questionnaire enough?

Not for critical suppliers. Ask for independent evidence, such as audit reports or certifications, and check what they cover.

What should we ask an outsourced bookkeeping provider?

Who can change supplier bank details, who confirms changes and how, who releases payments, how exceptions are reported to you, and how you get your records back if you leave.

Sources

All checked October 30, 2026.

• Verizon, 2025 Data Breach Investigations Report
• EUR-Lex, Regulation (EU) 2022/2554 on digital operational resilience (DORA)
• EUR-Lex, Implementing Regulation (EU) 2024/2956 on the register of information
• OSFI, Guideline B-10: Third-Party Risk Management

Related: Back office cyber exposure: your vendor is your attack surface, NIS2 and DORA compliance gets operational teeth and MDR vs MSSP.