1. 3rd Party Risk Categorization Process
3rd Party Risk Category Assessment Process
Process Risk Assessment: Determine if the activity performed by the 3rd Party is critical to the firm and identify the overall stability of the 3rd Party.
Data / Access Management Assessment: Determine if the method of interacting with the 3rd Party increases the risk to the firm.
3rd Party Resilience Assessment: For critical activities evaluate the completeness and effectiveness of resilience, response, and recovery programs. Determine the cost of replacing the 3rd Party after a catastrophic disruption
Process Risk Assessment
Activity Type
Service / Product Support
Intellectual Capital
3rd Party Entity Type
Financial Transactions/Credit Worthiness / Insurance
Industry Concentration
Data / Access Management Assessment
Data Access Methodology
Restricted / Confidential Information Management
Information Security Review Finding
Physical Security Access
Technology /Software Risk
3rd Party Resilience Assessment
Locations: Operations – Data Centers (Domestic / Foreign)
BC / DR / Incident Management
Resilience Factors: RTO/RPO/SPOF
Dependency Analysis
Replacement Challenges (Availability of alternative / Ease of / cost of transition)
3rd Party Risk Categories: Based on the results of the assessment determine the level of due diligence, and ongoing risk assessment required for the 3rd Party relationship. Vendor Risk Categories include:
Critical / Important / Medium / Low

2. 3rd Party Risk Category Assessment Guidance
Process Risk Assessment
Activity Type: Define activity types and associated risks levels.
Service / Product Support: Determine if the 3rd Party will support an essential service/product of the firm and the impact to the firm and its customers if the 3rd Party has a significant business disruption.
Intellectual Capital: Determine if the 3rd Party service provide will have exposure to the firm’s intellectual capital.
3rd Party Entity Type: Define the types of 3rd Party entity and the potential risks associated (Government / Self-Regulated / Public / Private)
Financial Transactions /Credit Worthiness / Insurance: Determine the volume and value of financial transactions involving the 3rd Party. Assess if the 3rd Party’s credit worthiness and if they have adequate insurance coverage.
Industry Concentration: Determine if the 3rd Party service provider supports a significant portion of the marketplace and if that service provider was out of operation how would it impact the industry.
Data / Access Management Assessment
Data Access Methodology: Define the methods for sharing information with 3rd party service providers and how much risk is associated with each method.
Restricted / Confidential Information Management: Determine the data privacy levels associated with the 3rd Party relationship and the level of risk associated with data privacy requirements
Information Security Review Findings: Critical 3rd Party service providers must go through a comprehensive information security review. Findings associated with this review must be assessed to determine the level of risk to the firm. If needed risk mitigation plans need to be developed before proceeding.
Physical Security Access: Validate that the 3rd Party service provider has adequate physical security to protect their ability to provide services to the firm as defined within the contract.
Technology / Software Risk: Assess the risks associated with the 3rd Party’s use of technology infrastructure and software. Determine the impact of specialized or customized use of the environment.
3rd Party Resilience Assessment
Locations: Assess the location of all operations and data centers that will support the service to determine if they are adequately geographically disbursed. Determine the risk associated with the domestic / international locations of the service provider including exposure to natural and man-made threats.
BC / DR / Incident Management: Assess the effectiveness of the 3rd Party service provider’s business continuity, disaster recovery and incident management programs to determine completeness and effectiveness.
Resilience Factors: Determine the value of various resilience factors for services provided by a 3rd Party Establish value parameters for each factor to determine the level of resilience required for critical services. Factors include: RTO (Recovery Time Objective), RPO (Recovery Point Objective), and SPOF (Single Point of Failure).
Dependency Analysis: Evaluate the dependency of the 3rd Party on additional external resources. Evaluate these relationships based on the potential impact to the service provided to your firm.
Replacement Challenges: Determine the cost in funds and effort to replace a 3rd Party service provider in the event that the 3rd Party is unavailable for a significant period of time, or has breached its legal obligations to the firm.