Third Party Tiering: The Cornerstone of a Strong Third-Party Risk Management Program

Noah Simon | September 7, 2018 | tag: Security Ratings

With the number of third parties connected to businesses increasing, risk and security teams need to ensure they are spending the right amount of attention on the right third parties. To do this, organizations need a clearly defined, tiered portfolio of third parties, vendors, and suppliers. Today, many companies tier their third parties based on the inherent risk they present, and the types of data they handle or have access to.

BitSight now enables customers to easily tier their third parties based on the criticality they present to their business. Customers who have gone through this exercise independently can simply replicate their tiers accordingly in the platform. Users can add a description of each tier and bulk add third parties they are monitoring to the appropriate tier.

Manage TiersManage Tiers is available on the homepage of BitSight Security Ratings portal


Tiering & Your Third Party Risk Workflow

Customers can use tiering to ensure they have alerts configured to help bring attention to the right third parties when pressing issues arise. For example, thresholds can be set for alerts when high-criticality third parties experience a drop of any kind. For third parties that are less critical, you can be alerted only for significant performance drops or for the specific risk vectors of greatest concern. Customers can dive into specific tiers to get a view of all companies with a specific risk profile.

Risk Matrix: Assess the State of Third Party Risk in One View

Once customers have configured tiering in their BitSight Security Rating portal, they will see a Risk Matrix on the home page. This matrix provides a clear risk posture overview, clearly illustrating which third parties have security issues that should be reviewed and acted on. Customers should start at the top right and work down to the bottom left of the matrix as they collaborate with third parties to improve risk posture on the most widely-used security ratings platform globally.Risk Matrix

The Risk Matrix is front and center on the homepage of BitSight Security Ratings portal.



Tiering is foundational to the success of any third party risk management program. To date, BitSight is the only security ratings platform that guides customers through tiering their portfolio of third parties to streamline workflows and prioritize actions for their program. Customers should reach out to our Customer Success team ( to ensure they are taking full advantage of Tiering, and be on the lookout for future enhancements soon.

security ratings snapshot 

Suggested Posts

Celebrating 10 Years of BitSight: A Co-Founder Looks Back

It’s hard to believe, but BitSight is celebrating our 10 year anniversary this week! I co-founded BitSight in 2011 with my friend and grad school classmate, Nagarjuna Venna. When I think back at our original idea of creating a global...


Use the right cybersecurity analytics to make a business case for risk management

Not long ago, corporate executives would give only passing thoughts to their organization’s cybersecurity postures. Leadership and board members would take notice in the wake of a major data breach, for example, or a couple of times a...


A response to Security Ratings - Love, Loathe or Live With Them

A week ago (which seems like a world ago given everything that’s happened with SolarWinds) Phil Venables -- formerly CISO of Goldman Sachs and now CISO of Google Cloud -- posted an interesting expose on security ratings this week. Phil...


Get the Weekly Cybersecurity Newsletter.