Third-party risk management for small businesses: securing the companies you depend on

Third-party risk management (TPRM) is the discipline of controlling the cyber risk that enters your business through the companies you rely on — software vendors, MSPs, cloud platforms, payroll providers, contractors, and every service that touches your data or connects to your systems. It exists because of an uncomfortable fact: you can run a disciplined security program internally and still be breached through a vendor you trusted, using access you granted.

Why third-party risk is disproportionately a small-business problem

Enterprises have vendor risk teams; small and mid-sized businesses have more vendors than employees and nobody assigned to think about them. Three structural facts make the exposure worse for smaller companies:

• You outsource more of your critical operations. Email, accounting, payroll, file storage, and often all of IT run on third parties. Each provider holds a concentration of your data and access that, internally, no single employee would have.
• Your MSP is your biggest single point of failure. A managed service provider typically holds administrative access to everything. Attackers understood this years ago: compromising one MSP yields dozens of downstream victims at once, which is why CISA has repeatedly warned about threat actors targeting MSPs specifically to reach their customers.
• You inherit incidents you didn't cause. When a vendor is breached, the notification obligations, customer conversations, and recovery costs land on you — while your contract with the vendor may cap their liability at a few months of fees.

The four ways vendor risk actually materializes

• Your data breached in their systems. The vendor holds your customer or employee data and loses it. You carry the legal and reputational consequences regardless of whose firewall failed.
• Their access used against you. A compromised vendor account, integration, or OAuth grant becomes the attacker's path into your environment — arriving through a connection you approved, with credentials you issued.
• Their software compromised at the source. Malicious code delivered through a legitimate update — the supply-chain pattern behind several of the most damaging incidents of the past decade. You installed it because you trusted the vendor; so did everyone else.
• Their identity used to defraud you. Vendor impersonation and compromised vendor mailboxes drive the most expensive variant of business email compromise: the invoice is real, the relationship is real, and only the bank details are the attacker's.

Right-sizing TPRM: tier your vendors, then match the effort

The reason most small-business vendor risk programs fail is that they try to treat every vendor identically, drown in questionnaires, and quit. The workable approach is tiering — spend your attention where a failure would actually hurt:

What a vendor risk assessment should actually ask

For critical and important vendors, skip the 300-question generic spreadsheet. A focused vendor risk assessment answers a short list of questions that predict real outcomes:

• What data of ours will you hold, and where? Data types, storage location, retention, and deletion on exit.
• What access will you have? Accounts, integrations, and permission scopes — and whether MFA is enforced on the vendor's side for access to your environment.
• What evidence of security do you have? A SOC 2 report or ISO 27001 certificate is a reasonable proxy for baseline discipline — read the scope and exceptions rather than filing it. No certification is not automatically disqualifying for a small vendor, but it moves the burden to specific answers.
• How will you tell us about an incident? A contractual notification commitment with a deadline (72 hours is a common ask), a named contact, and cooperation obligations.
• What happens when we leave? Data return and deletion, access revocation, and transition assistance — negotiated while you still have leverage, not during the divorce.

For the structure behind this, NIST's supply-chain risk management guidance, SP 800-161, is the reference framework — useful to know it exists and to borrow from, not to implement wholesale at small-business scale.

The controls that matter more than questionnaires

Assessment predicts risk; controls reduce it. Four practices do most of the work:

• Least-privilege vendor access. Scope every vendor account and integration to what the service actually needs, review the grants quarterly, and remove access the moment a relationship ends. Orphaned vendor accounts are among the most common quiet entry points.
• Independent verification for vendor payments. Bank-detail changes verified by a call to a known number — the single control that defeats vendor impersonation fraud.
• Concentration awareness. Know which single providers could take your business down, and decide deliberately whether you accept that, mitigate it, or diversify.
• Vendor scenarios in your incident plan. Your incident response plan should answer: what do we do the day our MSP, or our biggest SaaS provider, announces a breach? Who calls them, what access do we suspend, and what do we tell customers?

The new tier: AI vendors

AI tools deserve the same tiering logic plus two extra questions. First, data use: does the vendor train on your inputs, and can you contractually prevent it? An AI tool that ingests your customer data is a critical-tier vendor no matter how small the invoice — the same visibility problem that makes shadow AI dangerous applies doubly to unvetted AI vendors. Second, autonomy: if the tool acts in your systems — an agent with credentials, an integration that writes rather than reads — its permissions are part of your attack surface and belong under AI agent security review, not just procurement.

Who owns third-party risk

Vendor risk fails as a side-task because it spans procurement, legal, IT, and finance — so in practice nobody owns it, and the vendor list grows silently until an incident audits it for you. The fix is the same as for the rest of the security program: a structured risk assessment to establish which vendor relationships are actually material, and an accountable owner — in many small businesses, a fractional security leader — who keeps the inventory current, the tiers honest, and the exit clauses negotiated before they are needed. Your security is now a shared system; someone has to govern the sharing.