Third-party risk management services

We help reduce the growing risk of supply chain compromise.

Cybersecurity
Cybersecurity services
Cyber governance & compliance

Thales partners with you to identify and quantify cyber risk in third‑party suppliers. One vulnerable supplier can enable a major cyberattack across your organisation.

Key benefits

Identify, control and reduce cyber risk across your third-party ecosystem while strengthening compliance, security and stakeholder trust.

Attack vectors

Understand third-party attack vectors and develop strategies to mitigate risk.
Security and privacy

Enhance security and privacy by controlling third‑party risk across your entire supplier ecosystem.
Compliance standards

Ensure third-parties adhere to compliance standards that match your own.
Stakeholder trust

Reduce the likelihood and impact of incidents, while increasing stakeholder trust and protecting your brand reputation in case of third‑party incidents.
Uncover unknown risks

Uncover unknown risks to your systems, data, and operations. Score suppliers and vendors according to their risk profile. Pinpoint risks from third -parties and determine risk mitigation strategies. Ensure you are truly compliant with internal, industry and legal requirements.
Business continuity

More effectively manage third‑party security performance and relationships. Gain confidence in prospective suppliers. Optimise security in third‑party interactions. Reduce the likelihood and impact of third‑party attacks, ensuring business continuity even in the event of a supplier compromise.

Accurately identify and quantify third-party risk

Whether you're evaluating a prospective vendor, want to improve existing third-party security practices, or need help identifying supply chain attack vectors, we're here to support you. Our experienced team provides tailored solutions, from assessments and mitigation strategies to frameworks

Australia
New Zealand

Third‑party risk management services

Strengthening third‑party and supply chain security is critical as attacks grow in frequency and impact.

Learn more

A TPRM assessment can be conducted either on a one‑off basis or as part of an ongoing approach. It may be performed as an initial assessment covering all third‑party providers, prior to engaging a new supplier, or before entering new relationships with government partners.

It is also relevant when organisations undergo significant internal changes, modify contract terms, take on new capabilities with a supplier, or when a supplier’s holdings or business operations change significantly.

TPRM assessments are commonly carried out ahead of a merger or acquisition, as well as on a regular basis, such as through yearly audits. Managing third‑party risk is essential to protect your ecosystem, reputation and long‑term operational resilience.

Key features

Third-party risk is the risk to your internal systems, data, and operations exposed in dealing with an external supplier. Threats and risks exist in supplier ecosystems just like they affect your own. Your internal risk management processes may be airtight, but just one supplier who doesn’t perform due diligence in their own security can negatively impact your business.

Supply chain attacks are increasingly common. The Verizon 2025 Data Breach Investigations Report highlights a 68% year-on-year increase in breaches involving third parties, underscoring the growing exposure across supply chain ecosystems. Whether the vulnerability originates in a software supplier or a non-technical service provider, such as a facilities contractor, these risks must be identified to be effectively managed.

With the right assessments, frameworks, policies, and tools in place, you can extend risk management practices beyond the boundaries of your organisation to third parties. By effectively managing third-party risk, you reduce the chance of unwelcome, costly surprises. Accurately identify and quantify third-party risk with a TPRM assessment, followed by targeted mitigation strategies and incident response playbooks.

A thorough TPRM assessment can assist in safeguarding your organisation’s operational continuity, sensitive information and intellectual property, while fostering resilient, trustbased relationships with suppliers. The assessment follows a structured fourstep approach that starts with the identification of third-parties, continues with the collection of relevant evidence and artefacts, and includes a detailed assessment of third-parties. It concludes with reporting activities and ongoing remediation to address identified risks over time.

We have delivered TPRM assessment and remediation services over many years across a diverse range of industries and clients. This broad and deep experience enables us to help organisations identify risks and put in place appropriate controls to ensure data is well protected. Our teams support you throughout the development, design, remediation and assessment of your requirements. Our TPRM services are tailored to your needs and cover TPRM assessments, the development of mitigation strategies and incident response, as well as TPRM remediation services.