The Third-Party Risk Management Lifecycle Explained

The TPRM lifecycle has six stages: identify, onboard, contract, assess, monitor and offboard. Most programs do the first four reasonably well. They lose control in stage five, the long stretch between assessments where a vendor's risk changes and nobody is watching.

Stage 1: Identify and plan

Before a vendor is selected, the business states what it needs and what the vendor will touch. This is the cheapest moment to manage risk, because nothing has been signed.

Key questions:

• Will the vendor access customer data, internal systems or production infrastructure?
• Is the service critical? Would its failure stop a regulated activity?
• Is this "material outsourcing" under RBI or SEBI rules?
• Do we already depend heavily on this provider for other services?

The answers set the vendor's tier, and the tier decides how much of the rest of the lifecycle it goes through.

Stage 2: Due diligence and onboarding

Due diligence checks whether the vendor is who it says it is and whether it can be trusted. That means ownership, financial health, legal and regulatory history, certifications (ISO 27001, SOC 2), and for critical vendors, security controls.

A useful habit: check the vendor's external exposure before you send a questionnaire. Open ports, expired certificates, leaked credentials and spoofable email domains are visible from outside. They tell you which questions to ask and whether the answers you get back are credible.

We compare due diligence and risk assessment in detail in this post.

Stage 3: Contracting

The contract is the only control you keep once the vendor is live. For critical vendors, it should cover:

• Your right to audit, and the regulator's right to inspect
• Breach notification within a fixed number of hours
• Data location, handling, return and deletion
• Subcontracting rules and disclosure of key fourth parties
• Service levels and business continuity commitments
• Exit and transition support

The RBI's IT outsourcing directions list many of these as required contract terms for material IT outsourcing.

Stage 4: Risk assessment

The assessment measures how well the vendor's controls protect what it can reach. Depth follows tier:

Stage 5: Ongoing monitoring and remediation

This is where most programs break. The vendor passed its assessment. Now the relationship runs for one, three or five years.

An annual review won't catch a breach in month four. Ongoing monitoring needs three layers:

1. Continuous outside-in signals: external exposure, breach disclosures, leaked credentials, domain and email security.
2. Event triggers: a breach, an acquisition, a new data flow or a service change should restart the assessment, not wait for the calendar.
3. Periodic review: RBI's directions expect regulated entities to review the financial and operational condition of service providers at least annually.

Monitoring finds issues. Remediation closes them. Track every finding with an owner and a due date, and follow up until it's fixed.

[ADD] Nikunj: how long it took a real vendor to fix a finding, and what finally moved them.

This stage is where Foresee's Third-Party Risk Intelligence focuses. It watches every vendor across six areas, starts a reassessment automatically when a vendor is named in a breach, and gives vendors a team to help them answer and fix.

Monitoring outside-in means checking the same six areas for every vendor: brand, applications, network, email, public exposure and the dark web. It needs nothing installed on the vendor's side.

Stage 6: Offboarding

The relationship ends, but the risk doesn't end with the contract. Offboarding should:

• Revoke every account, API key, VPN and integration
• Confirm the vendor returned or deleted your data, in writing
• Move the service to a new provider without a gap
• Close the vendor's record with evidence for auditors

Orphaned vendor accounts are a common finding in audits and incident investigations. They are also one of the easiest to prevent.

Reporting runs across every stage

Reporting isn't a stage at the end. Management and the board need to see, at any time, how many vendors are in each tier, which critical vendors have open findings and how long those findings have been open. For the metrics that matter, see 12 TPRM metrics and KPIs.

FAQs

How many stages are in the TPRM lifecycle? Models vary from five to eight stages. The core is the same: plan, onboard with due diligence, contract, assess, monitor and remediate, and offboard.

Which stage matters most? Ongoing monitoring. It covers the longest period of the relationship and is where most real incidents happen.

Does every vendor go through every stage? Every vendor should be identified, contracted and offboarded properly. Assessment and monitoring depth should scale with the tier.

What triggers a reassessment outside the normal cycle? A breach disclosure, a change in ownership, a new type of data shared, a major service change or a serious finding from monitoring.

See which of your vendors needs attention now. Explore Foresee Third-Party Risk or get a free snapshot of five vendors.

Sources: RBI Master Direction on Outsourcing of IT Services · Summary of RBI IT outsourcing obligations, India Law Offices