Defining “Third Party” in Third-Party Information Risk Management

Authored by Giovanni Massard

Businesses today are interconnected and interdependent like never before in history, as such third-party risk is critically important to get right. This form of interdependency between businesses is in the form of outsourcing services, partnerships, and utilizing suppliers, third-party relationships are integral to achieving business outcomes. However, these relationships also introduce significant risks, particularly when it comes to managing access to sensitive information. Effective third-party risk management is essential in safeguarding an organization’s data and information assets. A critical component of this process is defining what constitutes a “third party” and why this term is the best choice for understanding and mitigating risks.

Defining the Term “Third Party”

In third-party risk management programs, clarity is key. A “third party” is any external entity that has access to an organization’s information or information assets. This definition goes beyond the specific roles these external entities play, such as vendors, suppliers, or service providers. Third-party information Risk Management focuses on areas of potential access these third parties may have to sensitive data or critical systems, which makes them a potential risk to the organization’s security, privacy, and overall operations.

While terms like “Outside Service Provider,” “Vendor,” or “Supply Chain Partner” are frequently used in the industry, these labels typically emphasize the function or role an external entity plays rather than the core risk—access to information and related systems. The term “third party” is more inclusive and flexible, capturing a broader spectrum of entities, irrespective of their role in the supply chain or service provision. Whether an entity is supplying goods, providing a service, or forming a strategic partnership, the term “third-party risk” focuses attention on the shared risk of information exposure or misuse.

Using the term “third party” allows organizations to adopt a more comprehensive approach to information risk management, one that addresses the core concern of data protection rather than simply the nature of the external relationship.

The Hidden Third Parties: Entities That May Not Appear Obvious

Many organizations focus their third-party information risk management efforts on the obvious entities—vendors, suppliers, contractors, and service providers. However, it is crucial to recognize that third-party risks extend beyond these traditional categories. Several other types of entities, which may not immediately appear as third parties, also pose risks due to their access to sensitive information.

1. Mergers, Acquisitions, Divestitures, and Joint Ventures (MADJVs)

Mergers, acquisitions, divestitures, and joint ventures (MADJVs) are prime examples of situations where the external relationship may not initially seem like a “third party” connection, but they often involve sharing valuable or sensitive information. When two or more organizations form a joint venture, they may exchange proprietary data or intellectual property, which creates a potential security risk. Similarly, during mergers and acquisitions, access to internal systems and databases is common, which makes both parties—regardless of ownership status—third parties from a risk perspective.

2. Hospitality Industry Case Study of Third-Party Risk in Acquisitions

In 2016, Marriott acquired Starwood Hotels, and during the transition, Marriott discovered Starwood’s systems had been breached, impacting up to 344 million customer records. The breach began in 2014, long before Marriott’s acquisition, but was not identified until 2018.

3. Government Entities

Government bodies, though often not part of an organization’s supply chain or service provision, also present third-party risks. These entities may have access to an organization’s data for regulatory, compliance, or investigative purposes. For instance, data shared with tax authorities, regulators, or law enforcement agencies can introduce risks related to compliance and security. These entities might not traditionally be seen as part of the business ecosystem, but their access to information demands careful management and oversight.

The HealthCare.gov website, which provides access to healthcare insurance under the Affordable Care Act, suffered a data breach in 2013, where hackers exploited vulnerabilities in the site’s system. Many private-sector individuals and organizations share sensitive health and financial data with HealthCare.gov to apply for coverage. Attackers were able to access personal information such as Social Security numbers, financial data, and healthcare preferences.

4. Non-Government Organizations (NGOs)

NGOs, which typically operate in healthcare, research, and international development, also represent third-party risks. These organizations often collaborate with businesses, sharing sensitive data for project work, research, or joint initiatives. Even though these relationships may be contractual or philanthropic, they still present information access points that must be managed carefully.

5. Customers

Even customers can be considered third parties in certain situations. In industries like e-commerce, financial services, or healthcare, customer data is regularly collected, processed, and stored. This access to information, while fundamental to business operations, also introduces risks. Customers can inadvertently compromise sensitive information, either through poor cybersecurity practices or through exposure to fraud and identity theft. Recognizing customers as potential third parties ensures that the security of data throughout its lifecycle is consistently maintained.

In the infamous Facebook-Cambridge Analytica scandal, millions of Facebook users (customers) unknowingly allowed third-party applications to access personal data. These third-party apps, which were created by developers using Facebook’s platform, gathered data through an application quiz or similar tools. The customer requested to use these applications but did not understand the privacy implications or failed to protect their personal data effectively. The third parties, like Cambridge Analytica, used this data inappropriately without users’ full knowledge or consent.

Focusing on Information Access, Not Just Roles

To fully appreciate why “third party” is the best term to use, it’s important to understand the scope and context of third-party risk management. This includes processes and data exchange between any external entity. Regardless of whether an external entity is a vendor, service provider, partner, government body, or customer, the real issue is the access it has to sensitive information and the potential consequences of that access.

A vendor or supplier may have direct access to systems that handle financial transactions, while a customer may provide sensitive personal data. An NGO might need access to research data, while a joint venture could involve sharing proprietary technologies. What all these entities have in common is their potential to expose, misuse, or compromise information. As such, the role or function an entity plays within the organization’s operational framework is secondary to the risk associated with information access.

By focusing on the term “third party,” organizations can take a broader, more inclusive approach to risk management, identifying and mitigating risks across all external relationships—not just the conventional ones. This mindset shift ensures that no potential risk area is overlooked, whether it comes from a traditional supplier or an unconventional source.

Operational Impact vs. Information Risk

While it is true that a third party’s operational failure can have a direct impact on an organization’s performance (e.g., a service provider fails to deliver critical services, or a supplier fails to deliver goods on time), the more significant risk generally lies in the access to and handling of sensitive information. The exposure of confidential information, whether intentional or accidental, can lead to severe consequences, such as data breaches, loss of intellectual property, regulatory penalties, loss of revenue, and reputational damage. As a result, third-party risk management should prioritize securing and monitoring access to information and proprietary business know-how instead of only managing operational relationships.

In Summary

Third-party risk management is an essential component of an organization’s broader risk strategy. With organizations increasingly relying on external entities to enhance efficiency, streamline operations, and innovate, understanding the risks associated with these relationships is more critical than ever. The term “third-party” provides a clear, inclusive definition that focuses more broadly and is more inclusive to all types of external relationships, which is central to managing risks effectively. By recognizing that the true risk comes from the potential exposure of sensitive information—whether through vendors, joint ventures, government bodies, or even customers—organizations can adopt a more comprehensive approach to safeguarding their most valuable assets. To be successful with third-party risk management programs, all third-party relationships must be identified, ranked in importance, assessed, managed, and monitored will help mitigate potential risks and protect the integrity of your business. Ultimately, managing third-party risks is about understanding and controlling access to information while building processes with procurement, legal, and other business units.