Third-Party Risk Management SUPPLIER

A process and platform that assesses and monitors the security posture of suppliers that access your systems or process your data, using questionnaires, external ratings and contract terms.

When you need it

• Suppliers connect to your systems remotely or process your customer data
• You are subject to the BDDK (Turkish banking regulator) outsourcing regulation
• Your risk of a software supply chain attack (infection through updates) is high

When you do not need it

• If you have few critical suppliers, an annual security questionnaire and security clauses in contracts are enough; no platform needed.

Tier suppliers by criticality and run deep assessments only on the critical ones. Their access should go through ZTNA/PAM and be logged.