TPRM Frameworks

A few years ago, when writing the first book "Cybersecurity & Third-Party Risk" and then working with TPRA to develop the Third-Party Cyber Risk Assessor Training and Certification, there was no accepted framework for Third-Party Risk Management. There were some cyber-focused supply chain frameworks from NIST and others, but none specifically for TPRM.

A few years ago, when writing the first book "Cybersecurity & Third-Party Risk" and then working with TPRA to develop the Third-Party Cyber Risk Assessor Training and Certification, there was no accepted framework for Third-Party Risk Management. There were some cyber-focused supply chain frameworks from NIST and others, but none specifically for TPRM.

Fast forward to the end of 2025, and we have two choices. Let me deal with my personal choice and favorite of the two: Third Party Risk Association's TPRM 101 Guidebook.

The Third Party Risk Association's TPRM 101 Guidebook provides a foundational guide for establishing a mature TPRM program, covering the lifecycle, fundamental definitions, best practices, and practical tools like examples, charts, and diagrams. It emphasizes the importance of TPRM for mitigating cybersecurity, compliance, and operational risks from third parties, detailing how to perform due diligence, assessments, structured onboarding, risk remediation, and continuous monitoring of vendors.

It provides for six phases:

1. Program Planning and Oversight (PPO)

1. Pre-Contract Due Diligence (PCDD)

1. Contract Review (CR)

1. Continuous Monitoring (CM)

1. Disengagement (D)

1. Continuous Program Improvement (CPI)

The acronyms at the end of each phase are required as they break out the framework into control pieces that are tracked by their acronyms and numbering. For example, on Continuous Monitoring (CM), there are five sub-categories listed as:

· Continuous Monitoring (CM)

o CM 1 – Ongoing Monitoring

o CM 2 – Site Visits

o CM 3 – Triggered (Ad-Hoc) Reviews

o CM 4 – Continuous Monitoring Tools

o CM 5 – Continuous Metrics and Reporting

The guidebook features a detailed description of best practices for each sub-category. The CM 1 - Ongoing Monitoring section begins with an explanation of when this phase commences, followed by the actions expected during this phase (such as ongoing risk assessments), recommendations on how frequently these should be conducted based on residual risk, and the tasks that must be completed. It thoroughly covers each phase and sub-category. The guidebook is approximately 140 pages long and includes useful appendices, such as Helpful Resources, Guidebook Definitions, Best Practices, and more.

This framework is a solid document that will benefit the industry and help ensure organizations can verify that their TPRM programs are complete.

The other is the Interagency Guidance, which serves as a framework for the finance industry. In June 2023, the OCC, FRB, and FDIC issued the “Interagency Guidance on Third-Party Relationships: Risk Management," marking a rare instance of agency cooperation driven by third-party risks. Originally, OCC made this a compliance issue, but now all three agencies collaborate on expectations for financial institutions.

The advantage of this regulatory guidance is that it can actually serve as a TPRM framework. It adopts a comprehensive lifecycle approach and outlines five phases:

· Planning: Assessing risks and benefits of a relationship before it starts.

· Due Diligence: Thoroughly evaluating potential third parties.

· Onboarding: Structuring the relationship for success.

· Monitoring: Continuously assessing risks and performance.

· Termination: Efficiently ending relationships while managing potential impacts.

Let's wrap up this blog with a reminder of why frameworks are essential:

• They ensure your policies, programs, and process include every potential risk and control consideration.
• They ensure your policies, programs, and processes include every potential risk and control consideration. The changes can be incorporated into your TPRM program.