UpGuard release notes show fourth-party data moving into operational workflows
API availability and questionnaire-remediation changes suggest that downstream visibility is being judged less as a map and more as data that must enter governed work.
Third-party risk news and market intelligence
Source-backed reporting, company dossiers, standards analysis, comparisons, and research for consequential third-party decisions.
Market pulse
Product IntelligenceUpGuard release notes show fourth-party data moving into operational workflowsRegulation & StandardsISO supplier-security standard enters systematic reviewRegulation & StandardsNIST turns supplier due diligence into a minimum viable practiceResearchUpGuard study maps vendor breach exposure across higher educationISO supplier-security standard enters systematic review
ISO/IEC 27036-1 remains the published supplier-relationship standard while its 2026 review determines whether the current edition should be confirmed, revised, or withdrawn.
NIST turns supplier due diligence into a minimum viable practice
The finalized C-SCRM quick-start guide gives organizations a clearer floor for evaluating technology suppliers before risk teams build a larger program around it.
Latest reporting
View newsroomStandards Watch
ISO supplier-security standard enters systematic review
ISO/IEC 27036-1 remains the published supplier-relationship standard while its 2026 review determines whether the current edition should be confirmed, revised, or withdrawn.
Analysis
NIST turns supplier due diligence into a minimum viable practice
The finalized C-SCRM quick-start guide gives organizations a clearer floor for evaluating technology suppliers before risk teams build a larger program around it.
Research Review
UpGuard study maps vendor breach exposure across higher education
The vendor-funded analysis shows the value—and the limits—of using relationship-scale datasets to understand concentration and downstream cyber exposure.
Regulatory Analysis
CPS 230 puts service-provider resilience into force in Australia
APRA's operational-risk standard now requires regulated entities to connect material service-provider oversight with critical operations, formal agreements, monitoring, and continuity planning.
Analysis
NIST pulls supply-chain risk into the system planning record
SP 800-18 Revision 2 treats cybersecurity supply-chain risk planning as part of the broader system risk record, raising the importance of traceable ownership and evidence.
News Analysis
OneTrust incident update puts third-party OAuth access under scrutiny
A compromised third-party integration involving Klue and Salesforce shows why application connections need their own inventory, ownership, and revocation playbook.
Standards and operating context
Open the standards libraryCurrent authoritiesOpen the complete standards library →
How the market is organized
Read the market analysisWorkflow and orchestration platforms
Systems built to coordinate intake, tiering, assessments, evidence, issues, approvals, reporting, and exit across the third-party lifecycle.
Explore the category →Cyber and multi-domain intelligence
External observations, entity data, ownership networks, financial health, geopolitical exposure, and other signals used to prioritize review.
Explore intelligence models →Exchanges and managed assessment
Reusable questionnaires, validated evidence, sector networks, and expert services intended to reduce duplicative diligence while preserving context.
Explore exchange models →GRC, procurement, and supplier suites
Third-party risk embedded in broader governance, source-to-pay, supplier management, resilience, audit, and compliance environments.
Open the market map →Coverage desks
Explore sector coverageFollow the market through the operating environments where third-party decisions carry different obligations, evidence requirements, and consequences.
Financial services
Third-party risk in financial services is shaped by operational resilience, formal lifecycle governance, concentration analysis, regulatory reporting, and evidence that can survive supervisory review.
Open the desk →Healthcare
Healthcare third-party risk joins cybersecurity, protected health information, patient-care continuity, connected technology, supplier evidence, and resource-constrained assessment operations.
Open the desk →Technology and data
Technology and data risk increasingly turns on software dependencies, cloud services, integrations, identity connections, data processors, open-source components, and the fourth parties behind a named provider.
Open the desk →Supply chain and industrial
Supply-chain and industrial third-party risk crosses supplier continuity, quality, financial health, ownership, trade exposure, geography, human rights, cyber risk, sub-tier dependency, and the physical movement of goods.
Open the desk →Company coverage
Open the company directory
Company and product changes
Open the change ledgerProduct releaseUpGuard adds fourth-party API access and questionnaire-remediation changes
Downstream relationship data is moving from static visualization toward integration with governed response workflows.
Standards lifecycleISO/IEC 27036-1 enters systematic review
Programs and vendors need version-aware standards records that distinguish a review milestone from a changed requirement.
Standards updateNIST finalizes its C-SCRM Due Diligence Assessment Quick-Start Guide
The guide gives buyers a neutral baseline for testing whether intake, evidence, review, escalation, and decision records support a defensible supplier-diligence process.
Market researchUpGuard publishes a higher-education vendor breach study
Relationship-scale datasets can reveal concentration and downstream exposure, while also increasing the importance of transparent methods and population boundaries.
Regulatory commencementAPRA CPS 230 enters force
Australian prudential entities now need a governed operating record that joins material service-provider data with operational-resilience decisions.
Standards updateNIST publishes SP 800-18 Revision 2
Third-party findings increasingly need to connect with systems, controls, owners, and planning records instead of remaining isolated in a vendor file.
Analysis and buyer research
All researchTHIRD PARTY CURRENT · 2026TPRM provider capability coverageIndependent market research
Original dataset
What providers document—and what the public record cannot establish
A transparent count of ten capability areas across the maintained company sample, with source scope and limitations attached.
Read the report →