Home / Knowledge hub / Fourth-party risk
Knowledge hub
Fourth-party risk
The risk that comes from your suppliers' own suppliers.
What it means
A third party is a supplier you contract with, such as a payment processor or a support tool. A fourth party is a supplier that your supplier relies on, such as the cloud host behind the payment processor. You have no contract with them, and often no name for them. Every supplier has a chain like this.
Fourth-party risk is what you carry because of that chain. If the supplier's supplier fails or is breached, your supplier is affected, and so are you. It reaches you without passing through a door you chose. The hidden part is the hard part.
Why it matters
Your customers hold you responsible for where their data goes, even when it passes through companies you never met. A breach at a hidden supplier still ends in your name on the notification, and your contract may not give you rights over it.
Regulators are paying attention. Rules such as GDPR require processors to get approval before engaging sub-processors, and frameworks like NIST SP 800-161 cover the supply chain beyond the first tier. A vendor risk process that stops at the first name is incomplete, and a security questionnaire should ask about subcontractors.
How it shows up
Start by asking each important supplier for its list of sub-processors and critical dependencies. Add contract terms that make them tell you of changes, flow security duties down to their suppliers, and report incidents quickly. Keep the answers in a register.
You cannot assess everyone. Focus on the suppliers that touch customer data or whose failure would stop you. The usual mistakes are collecting questionnaires nobody reads and treating the list as fixed. Re-ask each year, and also when a supplier announces a new subprocessor or a merger.
Questions people ask
Fourth-party risk, answered
What is the difference between third-party and fourth-party risk?
Third-party risk comes from suppliers you contract with. Fourth-party risk comes from the suppliers they depend on, with whom you have no direct agreement.
The same questions apply, but you must ask them through your supplier.
How can we find our fourth parties?
Ask suppliers for a list of sub-processors and key infrastructure providers. Many publish this, and under GDPR processors must keep you informed.
Check their trust pages and security reports as well.
Do we need to audit our fourth parties?
Usually not directly. You rely on your supplier's controls and your contract. For the most critical chains, ask for evidence such as audit reports.
Direct audits are rare and costly.
Can a contract remove the risk?
It moves some of the cost and gives you rights to notice and information. It does not stop the failure.
Plan for what you will do if a critical supplier or its supplier goes down.
Is cloud concentration a fourth-party risk?
Often. Many suppliers run on the same few cloud providers, so one outage can hit several of your tools at once.
Knowing the overlap helps you plan recovery. Ask suppliers where their services run.
Related
Terms that sit next to this one
Vendor risk management
Judging and monitoring the security of the suppliers your business relies on.
Security vendor assessment
Checking a supplier's security before you trust them with your data.
Third-party script risk
Code from outside vendors running on your pages with the same powers as yours.
Security questionnaire
The list of questions a buyer's security team sends before they sign.
Shared responsibility model
The split between what your cloud provider secures and what you must secure yourself.
Who sits behind your supplier?
We can only evidence what we test, which is the web app and APIs you run. Findings come with the request, response and proof, which helps when you answer supplier-risk questions. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.