[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"control:third-party-risk-management":3},{"control":4,"products":25,"stories":58,"lessons":102,"related":127,"compare":132},{"slug":5,"name":6,"problem":7,"summary":8,"business_value":9,"vendor_questions":10,"risk_register":15,"framework_refs":16,"area":21,"updated_at":24},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.","An inventory of suppliers ranked by how critical they are, security assessments before and during the contract, and monitoring for supplier incidents.","Supplier breaches have caused some of the largest incidents of recent years, through software updates, payroll services and file transfer tools. NIS2 and DORA both make supply chain security an explicit duty, and DORA requires a register of ICT providers. Knowing your critical suppliers and watching them turns a surprise into a planned response.",[11,12,13,14],"Does it rank suppliers by criticality and data access, instead of sending everyone the same questionnaire?","Does it monitor suppliers continuously for breaches and exposures?","Can it produce the DORA register of information?","How are our suppliers' own suppliers handled?","Risk: a breach at a critical supplier exposes our data or stops operations. Control: supplier inventory with criticality tiers, assessments and continuous monitoring. Owner: procurement together with the CISO. Measure: critical suppliers with a current assessment.",[17,18,19,20],"NIS2 Art. 21(2)(d) and 21(3): supply chain security","DORA Art. 28 to 30: ICT third-party risk and the register of information","CIS Control 15: service provider management","ISO\u002FIEC 27001:2022 A.5.19 to A.5.22: supplier relationships",{"name":22,"slug":23},"Supply Chain","supply-chain","2026-10-16T12:48:26.722314+00:00",[26,34,42,50],{"vendor_slug":27,"vendor_name":28,"vendor_logo":29,"product_slug":30,"product_name":31,"url":32,"description":33},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":35,"vendor_name":36,"vendor_logo":37,"product_slug":38,"product_name":39,"url":40,"description":41},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":43,"vendor_name":44,"vendor_logo":45,"product_slug":46,"product_name":47,"url":48,"description":49},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"total":59,"last_days":60,"recent":61},400,136,[62,67,72,77,82,87,92,97],{"slug":63,"title":64,"published_at":65,"brief":66},"city-of-osaka-warns-of-data-breach-impacting-1-million-as-japan-reels-from-dozen-72ccdc","City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents","2026-11-13T19:43:00+00:00","City of Osaka discloses breach affecting 1M email addresses via compromised third-party platform.",{"slug":68,"title":69,"published_at":70,"brief":71},"trezor-confirms-crypto-stealing-implants-in-three-wallets-releases-fix-d29629","Trezor confirms crypto-stealing implants in three wallets, releases fix","2026-11-13T19:38:36+00:00","Trezor confirms crypto-stealing implants in three Safe 5 wallets sold by CryptoBilis.",{"slug":73,"title":74,"published_at":75,"brief":76},"tsmc-confirms-employee-data-breach-tied-to-cloud-service-provider-ccd63f","TSMC confirms employee data breach tied to cloud service provider","2026-11-13T15:06:00+00:00","TSMC confirms employee data breach via cloud service provider, impacting current and former employees.",{"slug":78,"title":79,"published_at":80,"brief":81},"trezor-confirms-hidden-implants-in-cryptobilis-sold-wallets-that-can-steal-recov-ea8f2c","Trezor Confirms Hidden Implants in CryptoBilis-Sold Wallets That Can Steal Recovery Phrases","2026-11-13T13:54:20+00:00","Trezor confirms implants in crypto wallets sold by CryptoBilis can steal recovery phrases.",{"slug":83,"title":84,"published_at":85,"brief":86},"ncsc-cert-se-veckobrev-v-46-8d4dec","NCSC – CERT-SE veckobrev v.46","2026-11-13T10:00:00+00:00","Swedish cybersecurity agencies issue weekly brief highlighting recent cyberattacks and phishing campaigns.",{"slug":88,"title":89,"published_at":90,"brief":91},"rogue-remote-access-campaign-spread-through-screenconnect-add-on-researchers-say-bea9d2","Rogue remote-access campaign spread through ScreenConnect add-on, researchers say","2026-11-12T20:58:17+00:00","Rogue ScreenConnect add-on used to spread malware to managed endpoints.",{"slug":93,"title":94,"published_at":95,"brief":96},"connectwise-investigates-screenconnect-breaches-after-reports-of-incidents-at-ne-9b8ad6","ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations","2026-11-12T16:16:00+00:00","ConnectWise investigates ScreenConnect breaches linked to RMM+ extension exploitation.",{"slug":98,"title":99,"published_at":100,"brief":101},"notion-customer-data-compromised-in-fireworks-ai-hack-a39fcf","Notion Customer Data Compromised in Fireworks AI Hack","2026-11-12T11:08:52+00:00","Notion AI chat transcripts accessed in Fireworks AI hack affecting less than 1% of workspaces.",[103,107,111,115,119,123],{"slug":104,"title":105,"published_at":106},"hardware-implants-in-reseller-wallets-highlight-supply-chain-risks","Hardware Implants in Reseller Wallets Highlight Supply Chain Risks","2026-11-13T20:20:40.226+00:00",{"slug":108,"title":109,"published_at":110},"third-party-email-service-breach-exposes-77-million-addresses-across-400-organizations","Third-Party Email Service Breach Exposes 77 Million Addresses Across 400 Organizations","2026-11-13T20:20:22.449+00:00",{"slug":112,"title":113,"published_at":114},"third-party-cloud-provider-breach-exposes-tsmc-employee-data","Third-Party Cloud Provider Breach Exposes TSMC Employee Data","2026-11-13T16:22:01.669+00:00",{"slug":116,"title":117,"published_at":118},"compromised-iam-credentials-and-third-party-vendor-breaches-expose-customer-data-across-multiple-org","Compromised IAM Credentials and Third-Party Vendor Breaches Expose Customer Data Across Multiple Organizations","2026-11-13T11:21:34.52+00:00",{"slug":120,"title":121,"published_at":122},"third-party-screenconnect-add-on-abused-to-bypass-auth-and-deploy-rogue-rmm-tools","Third-Party ScreenConnect Add-On Abused to Bypass Auth and Deploy Rogue RMM Tools","2026-11-12T21:20:21.093+00:00",{"slug":124,"title":125,"published_at":126},"nearly-half-of-eu-it-providers-take-over-3-months-to-apply-critical-patches","Nearly Half of EU IT Providers Take Over 3 Months to Apply Critical Patches","2026-11-11T07:20:22.845+00:00",[128],{"slug":129,"name":130,"problem":131},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",{"securityscorecard\u002Fsecurity-ratings":133,"bitsight\u002Fbitsight-tprm":145,"onetrust\u002Fthird-party-management":154,"upguard\u002Fupguard-vendor-risk":163},{"hq_country":134,"also_provides":135,"reviews":136,"affected":143,"reported":144},"US",[],[137,140],{"label":138,"url":139},"PeerSpot: SecurityScorecard user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fsecurityscorecard-reviews",{"label":141,"url":142},"Gartner Peer Insights: SecurityScorecard TITAN AI user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Ftitan-ai",0,1,{"hq_country":134,"also_provides":146,"reviews":147,"affected":143,"reported":144},[],[148,151],{"label":149,"url":150},"PeerSpot: Bitsight user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fbitsight-reviews",{"label":152,"url":153},"Gartner Peer Insights: Bitsight Cyber Risk Intellligence user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fbitsight-cyber-risk-intelligence",{"hq_country":134,"also_provides":155,"reviews":156,"affected":143,"reported":143},[],[157,160],{"label":158,"url":159},"PeerSpot: OneTrust GRC user reviews","https:\u002F\u002Fwww.peerspot.com\u002Fproducts\u002Fonetrust-grc-reviews",{"label":161,"url":162},"Gartner Peer Insights: OneTrust Third-Party Management user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fonetrust-third-party-management",{"hq_country":164,"also_provides":165,"reviews":166,"affected":143,"reported":144},null,[],[167],{"label":168,"url":169},"Gartner Peer Insights: UpGuard Vendor Risk user reviews","https:\u002F\u002Fwww.gartner.com\u002Freviews\u002Fproduct\u002Fupguard-cyberrisk"]