Your Sunday briefing · Risk series
Your register now has its essential columns. You named the scenarios that would stop the business, gave each one its four owners, looked at what attackers see of you first, and last Sunday replaced "hackers" with a source that says who, why and how. One question remains that almost every register dodges: where are your vendors?
In most organizations, they live elsewhere. In another spreadsheet, kept by procurement or compliance, with a rating, an annual questionnaire and a renewal date. Our position: your vendor list is not a risk register. A third party that can stop the business belongs in the same register as your other risks, with its own scenarios, its owners and its likelihood.
Two files that never talk
The vendor register answers a useful question: is this supplier well managed? The risk register asks a different one: what could stop the business, and who decides? As long as the two live apart, three things become impossible.
- Comparing. The leadership team sees ten internal scenarios and no vendor scenario. It allocates its budget as if third parties did not exist, even though they often carry the heaviest dependencies.
- Deciding. A vendor rating that drops does not say which process is at stake or what losing it would cost. Nobody has the authority to say "we accept" or "we switch vendors", because the risk belongs to no one in leadership.
- Reacting. The day a vendor announces an incident, the first question is "what does this touch on our side?". If the answer is written nowhere, you look for it during the incident.
What it changes: the point is not to merge two files, but to bring into the risk register the third parties whose loss, compromise or access could stop an essential process.
What the frameworks and the numbers say
The NIST Cybersecurity Framework 2.0, published in February 2024, is explicit. Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management (GV.SC-03), and the risks posed by a supplier, its products and services, and other third parties are understood, recorded, prioritized, assessed, responded to and monitored over the course of the relationship (GV.SC-07). Recorded: not in a separate file, in the risk management process.
OSFI Guideline B-10, which applies to federally regulated financial institutions, adds two points useful to any organization. It defines the criticality of an arrangement by the impact of an incident, regardless of its likelihood. And it states that the absence of a written contract does not imply the absence of a third-party arrangement, or of third-party risk. Status: guidance published by the regulator.
The numbers point the same way. According to Verizon's 2026 Data Breach Investigations Report, released on May 19, breaches involving a third party now account for 48% of all breaches, up 60% in a year. Status: reported by Verizon, based on its own data. The Canadian Centre for Cyber Security's National Cyber Threat Assessment 2025-2026 lists vendor concentration as one of its trends: a cyber incident affecting a single dominant service provider can affect an entire sector. It also notes that through MOVEit alone, the CL0P group hit an estimated 2,750 enterprises and 94 million individuals by exploiting a file transfer product. Status: official assessment of the Government of Canada.
Three ways a third party enters a scenario
Go back to the four-part sentence from the first episode: a source, an event, what is affected, the business consequence. A third party can take three places in that sentence, and each gives a different scenario. The examples below are fictional.
1. The third party is the way in. It has access to your systems: an IT provider that administers your servers remotely, an integration holding an API key, a refrigeration contractor maintaining internet-connected controllers. Example: "A ransomware group compromises our IT provider's remote access tool and uses it to encrypt our servers; production stops for five days." The source is an attacker, but the path runs through the third party.
2. The third party holds what is affected. Your data sits with it: payroll, customer records, the e-commerce platform. Example: "Our payroll software vendor suffers a data theft; the personal information of our 400 employees is published; we must assess a privacy breach under our obligations." You were not attacked, but the consequence is yours.
3. The third party is the dependency. It stops, you stop. Example: "Our only carrier loses its dispatch systems for two weeks; we can no longer deliver to our three largest customers." There is nothing to "secure" on your side here. The treatment is a degraded mode, a second supplier or an exit plan, as our article on concentration risk explains.
What it changes: the same vendor can carry two or three scenarios. Your IT provider is both a way in and a dependency. Writing them separately means choosing a different treatment for each.
The series' columns apply to third parties too
A vendor scenario gets no special regime. It goes through the same columns as the others.
- The owners. The one who accepts is the executive whose process would stop, not the buyer who signed the contract. The one who treats is often the contract manager, with IT. The one who monitors follows the vendor's signals. The one who reports presents the scenario to the committee, like any other.
- Exposure. What the vendor exposes on the internet counts as much as what it declares in its questionnaire. A provider that says it is up to date while its VPN gateway is not is a signal.
- The source. Some groups specifically target providers that open the door to many customers at once. The Canadian Centre's assessment says it plainly: ransomware attacks against digital supply chains will almost certainly continue over the next two years.
The four traps
The rating taken for the risk. A vendor rating measures its posture, not your consequence. A well-rated vendor you cannot do without can remain your biggest risk.
The annual questionnaire taken for monitoring. It tells you what the vendor declared on one day of the year. NIST CSF asks for monitoring over the course of the relationship, not at signature.
The contract taken for the list. Apps installed in one click, mandatory sector platforms, the body you depend on without an invoice: as B-10 reminds us, no contract does not mean no third party.
The third party with no internal owner. "The vendor handles it" is not an owner. You can outsource operations, never the responsibility for the risk.
This week's test: thirty minutes, five vendors
Bring together the person who keeps the risk register and the one who keeps the vendor list.
- Take your five most critical third parties: the ones whose loss would stop an essential process within a week.
- For each, look in the risk register for scenarios that name it.
- For those that are missing, write a four-part scenario, choosing its place: way in, holder of your data, or dependency.
- Name the executive who would accept that risk.
Three results should worry you. A critical vendor missing from the register: nobody arbitrates its risk. An internal scenario that ignores an obvious third party, such as ransomware on the ERP with no mention of the host or the integrator: half the path is missing. A buyer as the only owner: the person who negotiates the price is not the one who carries the loss.
What you should have next Sunday
The same register, with five to ten more scenarios, each tied to a named third party and its place in the sentence. Next to each line, the executive who accepts it, and the date of the next signal to check at the vendor. Your vendor list stays useful: it now feeds the register instead of living next to it.
Where FortaRisks fits
To start, our free vendor security questionnaire generates a questionnaire tailored to each third party, and the TPRM readiness assessment places your program's maturity in a few minutes.
To follow those third parties continuously, Forta Suppliers cross-checks each vendor's questionnaire against an external scan of its real attack surface, with a first alert within 48 hours. Those signals flow into Forta Cockpit, the decision-makers' view, where the register lives: a vendor that deteriorates moves the scenarios that name it, not just its own record. The vocabulary is in our entry on third-party risk management.
Next Sunday: concentration in the register. When several scenarios hang on the same vendor, they are no longer several small risks. They are one big one, and should be seen as such.
Sources: NIST, Cybersecurity Framework 2.0 (CSWP 29, February 26, 2024) · OSFI, Guideline B-10, Third-Party Risk Management · Verizon, 2026 Data Breach Investigations Report (May 19, 2026) · Canadian Centre for Cyber Security, National Cyber Threat Assessment 2025-2026