Vendor Risk Management
Definition
Supplier risk management captures and limits risks from external providers throughout the entire collaboration.
The systematic assessment, treatment, and monitoring of risks from external providers throughout selection, contracting, operation, and termination.
Simply explained
You examine what could go wrong with a provider and plan countermeasures—from selection to the end of the collaboration.
Why it matters in practice
The term supports companies in selecting technologies sensibly, anchoring them organizationally, and using them competently.
Example from business
A medium-sized company assesses cloud providers for data access, subcontractors, resilience, and exit options.
Limits and pitfalls
- Questionnaires and certificates alone do not prove effective controls; concentration and chain risks remain.
Origin & history
Third-Party Risk Management evolved from procurement, information security, and supply chain management.
Use in mid-sized companies
- Possible example: A medium-sized company assesses cloud providers for data access, subcontractors, resilience, and exit options.
Frequently asked questions
What does supplier risk management mean?
The systematic assessment, treatment, and monitoring of risks from external providers throughout selection, contracting, operation, and termination. What should you pay attention to? Questionnaires and certificates alone do not prove effective controls; concentration and chain risks remain.
Sources
- NIST SP 800-161 Rev. 1 · NIST SP 800-161 Rev. 1
Source checked on 10.10.2026. Editorial application examples are hypothetical; no evidence of real customer results.
Editorially reviewed on: