• Support
  • Login
  • Contact
  • Blog
  • Support
  • Login
  • Contact
  • Blog
SecurityScorecard SecurityScorecard
  • Products
    PRODUCTS
    • Security Ratings
      Identify security strengths across ten risk factors.
    • Security Data
      Get actionable, data-based insights.
    • Security Assessments
      Automate security questionnaire exchange.
    • Attack Surface Intelligence
      NEW
      On-demand contextualized global threat intelligence.
     
    • Automatic Vendor Detection
      Uncover your third and fourth party vendors.
    • Cyber Risk Quantification
      Translate cyber risk into financial impact.
    • Reporting Center
      Streamline cyber risk reporting.
    • SecurityScorecard Marketplace
      Discover and deploy pre-built integrations.
    BUY NOW
    • Compare All Plans
      Choose a plan that's right for your business.
    • Try Free Account
      Make informed decisions with confidence.
    • Buy Pro Now
      Add automated event responses.
    • Buy Business Now
      Expand on Pro with vendor management and integrations.
    • Request Enterprise Demo
      See the capabilities of an enterprise plan in action.
    icon__SSClogoMark icon__SSClogoMark

    Understand and reduce risk with SecurityScorecard.

    Free account sign up
  • Services
    SERVICES NEW
    • Digital Forensics & Incident Response
      Prepare to respond to any threat.
    • Third-Party Risk Management
      Reduce risk across your vendor ecosystem.
    • Cyber Risk Intelligence
      Partner to obtain meaningful threat intelligence.
     
    • Penetration Testing
      Uncover your vulnerabilities before an attack does.
    • Red Team
      Use scenarios to perform a simulated attack.
    • Tabletop Exercises
      Test your incident response plan & bolster your readiness.

    Under Cyber attack?

    Contact us for immediate support if you believe your organization is the victim of a cyber attack.

    Contact Cyber 911 Team
  • Solutions
    BY USE CASE
    • Compliance
    • Cyber Insurance
    • Digital Forensics
    • Due Diligence
    • Enterprise Cyber Risk
    • Executive-Level Reporting
    • Incident Response
    • Regulatory Oversight
    • Third-Party Risk
    BY INDUSTRY
    • Critical Infrastructure
    • Enterprise
    • Financial Services
    • Government
    • Healthcare
    • Insurance
    • Retail & Consumer
    • Technology
    Help your organization calculate its risk
    View All Solutions
  • Customers
    OUR CUSTOMERS
    • Customer Overview
      Trusted by companies of all industries and sizes.
    • Peer Reviews
      Find out what our customers are saying.
    SUCCESS AND SUPPORT
    • Customer Success
      Receive award-winning customer service.
    • Support
      Get your questions answered by our experts.
    COMMUNITY
    • SecurityScorecard Connect
      Engage in fun, educational, and rewarding activities.
    • Connect Login
      Join our exclusive online customer community.
    icon__SSClogoMark icon__SSClogoMark
    Understand and reduce risk with SecurityScorecard.
    Free account sign up
  • Partners

    Partner Program Overview

    Partner with SecurityScorecard and leverage our global cybersecurity ratings leadership to expand your solution, deliver more value, and win new business.

    Learn more
    • Locate a Partner
      Access our industry-leading partner network.
    • Value-Added Resellers
      Enter new markets, deliver more value, and get rewarded.
    • Managed Service Providers
      Meet customer needs with cybersecurity ratings.
    • ISAC Partner Program
      Learn more about the industries we support and ISAC member benefits.
    • Technology Alliances
      Access innovative solutions from leading providers.
    • SCORE Portal Login
      Use the SCORE Partner Program to grow your business.
    • SecurityScorecard Marketplace
      Find a trusted solution that extends your SecurityScorecard experience.

    Understand and reduce risk with SecurityScorecard.

    Free account sign up
  • Resources
    RESOURCES
    • Resource Center
      Explore our cybersecurity ebooks, data sheets, webinars, and more.
    • SecurityScorecard Blog
      Read the latest blog posts published weekly.
    • Research & Insights Center
      Access our research on the latest industry trends and sector developments.
    • SecurityScorecard Academy
      NEW
      Complete certification courses and earn industry-recognized badges.
    TOOLS AND DOCUMENTATION
    • Free Security Rating
      Get your free ratings report with customized security score.
    • Product Release Notes
      Visit our support portal for the latest release notes.
    • Free Account Signup
      Start monitoring your cybersecurity posture today.
    • Chrome Extension
      NEW
      Show the security rating of websites you visit.
    • Assessments ROI Calculator
      Calculate the ROI of automating questionnaires.
    Trust begins with transparency. Take a look at the data that drives our ratings.
    Learn more
  • Company

    Working at SecurityScorecard

    Committed to promoting diversity, inclusion, and collaboration–and having fun while doing it.

    Join our team
    • About Us
      SecurityScorecard is the global leader in cybersecurity ratings.
    • Leadership
      Meet the team that is making the world a safer place.
    • Press
      Explore our most recent press releases and coverage.
    • Events
      Join us at any of these upcoming industry events.
    • Policy Insights
      Raising the bar on cybersecurity with security ratings.
    • Careers
      APPLY TODAY
      Come join the SecurityScorecard team!
    • Contact Us
      Contact us with any questions, concerns, or thoughts.
    • Trust Portal
      Take an inside look at the data that drives our technology.
    • Help Center
      We are here to help with any questions or difficulties.
Request a demo
SecurityScorecard SecurityScorecard
  • Support
  • Login
  • Contact
  • Blog
  • Support
  • Login
  • Contact
  • Blog
SecurityScorecard SecurityScorecard
  • Products
    PRODUCTS
    • Security Ratings
      Identify security strengths across ten risk factors.
    • Security Data
      Get actionable, data-based insights.
    • Security Assessments
      Automate security questionnaire exchange.
    • Attack Surface Intelligence
      NEW
      On-demand contextualized global threat intelligence.
     
    • Automatic Vendor Detection
      Uncover your third and fourth party vendors.
    • Cyber Risk Quantification
      Translate cyber risk into financial impact.
    • Reporting Center
      Streamline cyber risk reporting.
    • SecurityScorecard Marketplace
      Discover and deploy pre-built integrations.
    BUY NOW
    • Compare All Plans
      Choose a plan that's right for your business.
    • Try Free Account
      Make informed decisions with confidence.
    • Buy Pro Now
      Add automated event responses.
    • Buy Business Now
      Expand on Pro with vendor management and integrations.
    • Request Enterprise Demo
      See the capabilities of an enterprise plan in action.
    icon__SSClogoMark icon__SSClogoMark

    Understand and reduce risk with SecurityScorecard.

    Free account sign up
  • Services
    SERVICES NEW
    • Digital Forensics & Incident Response
      Prepare to respond to any threat.
    • Third-Party Risk Management
      Reduce risk across your vendor ecosystem.
    • Cyber Risk Intelligence
      Partner to obtain meaningful threat intelligence.
     
    • Penetration Testing
      Uncover your vulnerabilities before an attack does.
    • Red Team
      Use scenarios to perform a simulated attack.
    • Tabletop Exercises
      Test your incident response plan & bolster your readiness.

    Under Cyber attack?

    Contact us for immediate support if you believe your organization is the victim of a cyber attack.

    Contact Cyber 911 Team
  • Solutions
    BY USE CASE
    • Compliance
    • Cyber Insurance
    • Digital Forensics
    • Due Diligence
    • Enterprise Cyber Risk
    • Executive-Level Reporting
    • Incident Response
    • Regulatory Oversight
    • Third-Party Risk
    BY INDUSTRY
    • Critical Infrastructure
    • Enterprise
    • Financial Services
    • Government
    • Healthcare
    • Insurance
    • Retail & Consumer
    • Technology
    Help your organization calculate its risk
    View All Solutions
  • Customers
    OUR CUSTOMERS
    • Customer Overview
      Trusted by companies of all industries and sizes.
    • Peer Reviews
      Find out what our customers are saying.
    SUCCESS AND SUPPORT
    • Customer Success
      Receive award-winning customer service.
    • Support
      Get your questions answered by our experts.
    COMMUNITY
    • SecurityScorecard Connect
      Engage in fun, educational, and rewarding activities.
    • Connect Login
      Join our exclusive online customer community.
    icon__SSClogoMark icon__SSClogoMark
    Understand and reduce risk with SecurityScorecard.
    Free account sign up
  • Partners

    Partner Program Overview

    Partner with SecurityScorecard and leverage our global cybersecurity ratings leadership to expand your solution, deliver more value, and win new business.

    Learn more
    • Locate a Partner
      Access our industry-leading partner network.
    • Value-Added Resellers
      Enter new markets, deliver more value, and get rewarded.
    • Managed Service Providers
      Meet customer needs with cybersecurity ratings.
    • ISAC Partner Program
      Learn more about the industries we support and ISAC member benefits.
    • Technology Alliances
      Access innovative solutions from leading providers.
    • SCORE Portal Login
      Use the SCORE Partner Program to grow your business.
    • SecurityScorecard Marketplace
      Find a trusted solution that extends your SecurityScorecard experience.

    Understand and reduce risk with SecurityScorecard.

    Free account sign up
  • Resources
    RESOURCES
    • Resource Center
      Explore our cybersecurity ebooks, data sheets, webinars, and more.
    • SecurityScorecard Blog
      Read the latest blog posts published weekly.
    • Research & Insights Center
      Access our research on the latest industry trends and sector developments.
    • SecurityScorecard Academy
      NEW
      Complete certification courses and earn industry-recognized badges.
    TOOLS AND DOCUMENTATION
    • Free Security Rating
      Get your free ratings report with customized security score.
    • Product Release Notes
      Visit our support portal for the latest release notes.
    • Free Account Signup
      Start monitoring your cybersecurity posture today.
    • Chrome Extension
      NEW
      Show the security rating of websites you visit.
    • Assessments ROI Calculator
      Calculate the ROI of automating questionnaires.
    Trust begins with transparency. Take a look at the data that drives our ratings.
    Learn more
  • Company

    Working at SecurityScorecard

    Committed to promoting diversity, inclusion, and collaboration–and having fun while doing it.

    Join our team
    • About Us
      SecurityScorecard is the global leader in cybersecurity ratings.
    • Leadership
      Meet the team that is making the world a safer place.
    • Press
      Explore our most recent press releases and coverage.
    • Events
      Join us at any of these upcoming industry events.
    • Policy Insights
      Raising the bar on cybersecurity with security ratings.
    • Careers
      APPLY TODAY
      Come join the SecurityScorecard team!
    • Contact Us
      Contact us with any questions, concerns, or thoughts.
    • Trust Portal
      Take an inside look at the data that drives our technology.
    • Help Center
      We are here to help with any questions or difficulties.
Request a demo
SecurityScorecard SecurityScorecard
BLOG

What is Fourth-Party Vendor Risk Management? What You Need to Know

Private: Jeff Aldorisio
06/25/2020

Third-party vendors aren’t the only service providers your organization needs to examine and audit. You should also be keeping tabs on their vendors as well.

It can be tough to know where to draw the line on your vendor’s vendors, also known as fourth-party vendors. Are you required to manage all fourth-party vendors? Well, let’s look at the following possible scenario:

If your company enlists the services of 50 vendors in your supply chain and 20 of them are utilizing a particular provider for a critical service, what happens if that critical service provider is hacked or experiences downtime?

Even small service providers can cause a major disruption to your organization’s day to day dealings. For instance, in 2016, DNS provider, Dyn, experienced a denial of service (DDoS) attack, which resulted in numerous customers, including PayPal and Amazon, going offline during the attack. If your company had used Dyn’s DNS services, you could have been impacted by the outage.

Here’s everything you need to know about fourth-party vendor risk management in order to keep your company safe.

Who are fourth-party vendors?

A fourth party vendor is a service provider with whom you do not have a direct contract. However, your vendor does have a business relationship with them for their services or products. As with your enterprise, your vendors are deeply dependent on some of their vendors, and these are the ones you need to keep an eye on. These vendors will show up in your vendor’s SOC reports and should be identified by your service provider as those classified as crucial in their own vendor management matrix.

SSAE 18 reports

With the introduction of SSAE 18 reports to the market in 2017, your third-party vendors are responsible for telling you about their critical vendors, or your fourth parties. This makes it simpler for you to know exactly which ones you should be vigilantly monitoring.

What you need to know about your fourth party vendors

You should understand the following three items about your fourth party vendors, including:

  1. Who they are.
  2. What services or products they provide to your vendor that causes them to be significant to operations.
  3. What your service provider has done for cybersecurity due diligence on their part for these vendors.

When you thoroughly understand these three aspects of your fourth party vendors, you can better anticipate possible threats that could be residing a level deeper. A breach to a fourth party vendor could be as impactful as a breach of your third-party service provider.

How fourth-party vendors can pose a threat to your business

Here are several ways a fourth party vendor could be a risk to your organization:

  • Your company’s sensitive data is being stored or transmitted by a fourth party vendor and could be exposed if their system is breached.
  • If the fourth party vendor experienced an issue, dependent services, such as payment processing, could fail on your end to your clients.
  • The downtime of a fourth party vendor may be visible to your own clients.

What actions can you take to assess fourth-party vendor risks?

Here are some steps you can take to thoroughly evaluate fourth-party risks:

  • If applicable, have your third-party vendor contractually commit to notifying you before forming a relationship with a fourth party vendor.
  • Review your third-party vendor’s SSAE 18 report to identify fourth-party vendors.
  • You probably will not have a direct contractual relationship with a fourth party vendor. This will be with your third-party vendor. You will need to request that they help you with obtaining any documents needed to perform your due diligence on the fourth party vendor.

What if a fourth party poses a threat to your business?

Most fourth-party vendors will carry some level of threat to your enterprise. If you find out that the fourth party does present a significant risk to your business, you should:

  • Contact your third-party vendor and reveal your findings. You also want to fully comprehend the nature of the relationship between the third- and fourth-party vendors.
  • Once you have a full picture of all of the potential risks, you will need to take the proper steps in order to mitigate them. These could include reviewing the original contract and amending some sections or creating a new contract altogether.

How SecurityScorecard can help with fourth-party vendor risks management

SecurityScorecard’s security ratings platform allows your business to create vendor profiles that provide clear visibility across 10 groups of threat factors, including network security, endpoint security, web application security, social engineering, and hacker chatter.

Despite the fact that you don’t have a working relationship with fourth-party vendors, they still can pose a real threat to your ecosystem. Continuous monitoring and due diligence are critical to keeping your business safe and sound.

Return to Blog
Join us in making the world a safer place.
FREE ACCOUNT SIGN UP
Products
Solutions
Customers
Marketplace
Partners
Resources
Company
Trust Portal
Security Ratings
Login
Blog
Contact
Careers

SecurityScorecard
Tower 49
12 E 49th St
Suite 15-100
New York, NY 10017

[email protected]

United States: (800) 682-1701
International: +1(646) 809-2166
Social-linkedin Social-facebook Twitter Instagram Youtube