LDCs rely on vendors, cloud platforms, consultants, managed IT providers, and other partners to deliver critical services. These relationships provide significant value, but they also extend risk beyond an LDC’s own systems, facilities, and workforce. Third-party risk management is a broad topic, encompassing many considerations. This article offers a practical starting point, highlighting key steps LDCs can take to manage vendor-related exposures, with a particular focus on cyber risk.
When a third-party experiences a cyberattack, operational failure, service interruption, financial challenge, or contractual dispute, the consequences can quickly affect the LDC. This exposure is significant. Customers may lose access to services, employees may be unable to perform essential work, sensitive information may be exposed, and regulatory or contractual obligations may be affected. The fact that the event originated outside the organization does not reduce its impact—or the expectation that the LDC will respond effectively.
| 30% of analyzed breaches involved a third party—approximately double the share reported the previous year. [i] |
Effective third-party risk management begins before a contract is signed. Assess vendors before engagement based on the importance of their services and their access to systems, facilities, operational technology (OT), customer information, and sensitive data. Reviews should address financial stability, cybersecurity, privacy, insurance, compliance, subcontractors, and business continuity.
A 2025 industry survey found that organizations are managing more vendors than ever before, with many now overseeing hundreds – or even thousands – of third parties.
Use risk tiers to match oversight to exposure. Low-risk suppliers may need only a basic review; providers supporting critical infrastructure, hosting data, or connecting to corporate or OT systems require enhanced assessment, approval, and monitoring.
Contracts are one of the most important tools for translating risk expectations into clear, enforceable responsibilities. Contract requirements should be supported by appropriate insurance coverage and regular verification that coverage remains in force.
| 35.5% of breaches were third-party related, and 41.4% of ransomware attacks originated through third parties.[ii] |
At a minimum, agreements should clearly define:
Where vendors access networks, applications, data, or facilities, apply least-privilege access, multi-factor authentication, separate vendor accounts, activity logging, secure remote access, periodic reviews, and prompt access removal.
Consider this scenario: A critical cloud platform fails. Can the LDC switch providers, use a manual workaround, recover its data, and communicate with affected stakeholders?
Continuity planning should cover critical vendor outages, supply-chain failures, cyber incidents, telecommunications interruptions, and contractor shortages. For each dependency, identify backup suppliers, redundant services, manual workarounds, internal capabilities, and recovery steps.
Vendor risk changes as services, ownership, finances, subcontractors, technology, and threats evolve. Reassess critical and high-risk providers periodically, assign owners to identified gaps, and track remediation.
It is important to maintain a current vendor inventory showing the business owner, services, data, connectivity, contract dates, risk tier, insurance status, and last review date. This helps leadership to see critical dependencies and concentrations of risk.
Manage risk through offboarding. Disable accounts and remote access, recover equipment and records, transfer or destroy data securely, address outstanding obligations, and confirm that replacement services can be implemented without unacceptable disruption.
Identify and classify critical vendors, assess them before engagement, set clear contract and insurance requirements, restrict access, test continuity plans, monitor issues, and maintain an exit plan.
Consider setting aside time once a month to meet with the relevant stakeholders from IT, operations, procurement, finance, and risk management to review vendor risk. This is an opportunity to discuss changes in vendor services or access, raise any new concerns, and follow up on outstanding items. Be clear about who is responsible for each action and when it should be completed. A regular discussion helps keep everyone informed and vendor risk management on the radar.
A disciplined, risk-based approach helps identify and address vulnerabilities before a vendor issue escalates into an organizational crisis.
[i] Verizon. (2025). 2025 data breach investigations report. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
[ii] Verizon. (2025). 2025 data breach investigations report (DBIR). Verizon Business. https://www.verizon.com/business/resources/reports/2025-dbir-data-breach-investigations-report.pdf
At The MEARIE Group, we remain committed to providing the most up-to-date insights on risk management and industry best practices. Should you have any questions or require further information, please do not hesitate to reach out.