What is Fourth-Party Risk vs. Third-Party Risk?

Monitoring and managing third-party risk has become a top priority for organizations. But cyber risk also lurks in your fourth-party and extended ecosystem. While you may have cybersecurity practices and controls in place, your vendors’ vendors, their vendors, and so on, may not. Because of the interconnectedness of today’s digital supply chain, fourth-party vendors pose a significant risk to your organization’s security posture. For this reason, it’s important to understand and monitor risk across your entire attack surface.

But what is third-party vs fourth-party risk and how can you efficiently manage both. Let’s look at the difference and how you can factor both into your cyber risk management strategy.

What is fourth-party risk?

Fourth parties represent a huge ecosystem that encompasses your vendor’s vendors or any third-party organization that connects to their network and business operations. Therefore, fourth-party risk is the significant cyber threat that this extended, complex, and invisible web of interconnected business relationships poses to your organization. Without a clear understanding of the business relationships and security posture of these fourth and nth parties, your organization could be at risk.

For example, if a vendor ceases operations because of a security incident affecting one of their critical vendors – your business is also impacted. If that cyber incident involves a data breach and that fourth-party vendor has access to your organization’s sensitive data, then you risk being compromised. You might also, inadvertently, be violating data protection regulations such as GDPR. HIPAA, and PCI security standards.

Additionally, you could be held liable for data loss and face reputational and financial risk. Indeed, the SSAE-18 audit standard includes language requiring that organizations appropriately manage both third- and fourth-party risk. 

What is third-party risk? 

Third parties are vendors, suppliers, or partners that your organization depends on to execute its business strategy. Third-party risk represents the cyber threat that these vendor relationships carry, including cybersecurity, regulatory, financial, and operational risk. Often these parties are directly connected to your network or have connected software that resides on your network.

Examples of potentially risky third-party vendors include:

• Software companies, such as cloud service providers and IT system monitoring vendors.
• Critical business vendors, including accounting, payroll, and HR firms.

Whatever the relationship, these companies may have access to your operations, including potentially sensitive data – and that introduces risk.

If a third-party fails to maintain the same high security standards as your organization, any vulnerabilities on their side could provide a conduit for threat actors to perpetrate supply chain security hacks. For example, cyber criminals often plant malware on an IT vendor’s software before it is pushed out to customers (as was the case with the 2020 SolarWinds hack).

The impact of these hacks is huge and can include downtime, investigation costs, regulatory fines, and reputational damage. This is why you need a comprehensive third-party risk management (TPRM) solution that helps you continuously monitor, assess, and remediate risk efficiently and expeditiously.

Why is fourth-party risk management increasingly important to business leaders?

Due to the increased frequency and sophistication of cyber-attacks, especially highly prevalent supply chain attacks, vendor risk management has emerged as an urgent priority for the C-suite and board.

Indeed, Gartner research shows that 88% of boards now regard cybersecurity as a business risk rather than solely a technical IT problem. And, by 2026, at least 50% of C-level executives' employment contracts will include cyber risk performance requirements. Consequently, security and risk management leaders are being asked to report to the board and C-suite on their security and risk programs. 

But fourth-party risk is a significant blind spot. The solutions offered by security and risk management firms simply don’t provide visibility into the security posture of your vendors’ subcontractors. Without the ability to report on fourth-party risk in a measurable and meaningful way, it becomes much harder to fight for the appropriate budget and resources. This will create gaps in your risk management program.

How to effectively manage fourth-party risk

According to KPMG, 79% of senior TPRM professionals say that they urgently need to improve how they identify and assess fourth parties in their supply chain. Fourth-party risk management is challenging and traditionally has involved close collaboration with your vendors. 

For example, very few companies maintain an inventory of their fourth parties. Instead, they rely on third parties to perform due diligence on these companies. But enforcing and validating the measures your vendors take to mitigate any risk that could impact you is notoriously difficult.

As a security leader, you may find yourself asking the following questions:

• How can we gain visibility into fourth-party relationships (especially vendors that our vendors most depend on)?
• How can we assess concentrated risk (critical areas of risk in the supply chain that could impact our business in the event of a breach or other cyber-attack)?
• What’s the best way to communicate program performance and assure stakeholders that fourth-party risk is under control?

Instead of relying on your vendors to provide information on their suppliers or trust that they are monitoring their security performance, you can use Bitsight for Fourth-Party Risk Management to monitor and manage the risk surface of your vendor supply chain:

1. Identify fourth-party connections:

Bitsight automatically identifies vendor connections with other organizations and offers dashboard views into potentially risky fourth parties based on their security ratings.

2. Identify product connections:

Easily discover the fourth-party products and services your third-party network is most dependent on. Uncover the interdependencies between third-, fourth-, and nth parties.

3. Discover a fourth-party’s security posture:

See each fourth-party’s security rating for a quick view of concentrated risk. Understand the downstream impacts of a cyber incident.

4. Get alerted to new and pressing fourth-party risks:

Continuously monitor your extended supply chain and receive alerts if a security incident occurs that may affect you and new relationships that pose risk.

5. View dashboard-based reports:

Get a centralized summary of fourth-party security incidents and easily report on fourth-party risk. Provide stakeholders with credible evidence that your fourth parties’ security controls are being managed effectively.

6. Validate your vendors’ risk reduction strategies:

Ensure your vendors are following infosec best practices to reduce risk in their vendor portfolio.

With these insights, it becomes much easier to manage the risk surface of your vendor supply chain and, if necessary, diversify your exposure to risky service providers. Learn more about third-party vs. fourth-party risk management, and how new enhancements in the Bitsight platform can help you get ahead of evolving risk in this hidden ecosystem.