Criticality Critical Active

Third-Party Risk Management Program

Establishes TPRM program including governance, scope, classification, roles, risk governance, metrics, reporting, review, compliance, and continuous improvement for third-party risk management.

Control ID
TPR-001
Domain Code
TPR
Control Nature
Detective
Business Owner
TPRM / CISO
Category
Administrative
Compensating Control
No

Control Overview

TPR-001 · Full Control Profile
Business Description

Establish and maintain an enterprise Third-Party Risk Management (TPRM) program to govern the identification, assessment, treatment, monitoring, and oversight of risks associated with third-party relationships throughout their lifecycle.

Business Objective

Ensure third-party risks are managed consistently while supporting regulatory compliance, operational resilience, and business objectives.

Business Benefits

    Business Risks if Missing

      Stakeholders, Industries & Technologies

      TPR-001 · Operating Context

      Primary Stakeholders

      Applicable Industries

      Applicable Technologies

      Mapped Regulatory & Industry Frameworks

      Harmonized Framework Mappings

      The following compliance and regulatory frameworks map directly to this control's governance scope.

      FRAMEWORK CODE FRAMEWORK NAME & DESCRIPTION FAMILY / CATEGORY VERSION ACTION
      COBIT2019 COBIT COBIT is an enterprise governance and management f...
      COBIT
      Governance Framework
      		 v2019 View →
      DORA Digital Operational Resilience Act The EU Digital Operational Resilience Act establis...
      EU
      Regulation
      		 vCurrent View →
      GDPR General Data Protection Regulation (GDPR) The General Data Protection Regulation is a bindin...
      EU
      Regulation
      		 vCurrent View →
      IRDAI IRDAI Information & Cyber Security Guidelines IRDAI information and cyber-security requirements...
      India
      Guideline
      		 vLatest View →
      ISO27001 ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for...
      ISO
      Standard
      		 v2022 View →
      NIS2 NIS2 Directive The NIS2 Directive establishes EU-wide cybersecuri...
      EU
      Directive
      		 vCurrent View →
      NIST-CSF NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev...
      NIST
      Framework
      		 v2 View →
      NIST80053 NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i...
      NIST
      Control Catalog
      		 vRev. 5 View →
      NPCI-ISR NPCI Information Security Requirements NPCI information-security requirements define cont...
      India
      Standard
      		 vLatest View →
      PCI-DSS PCI DSS PCI DSS is an industry security standard maintaine...
      PCI
      Standard
      		 v4 View →
      RBI-CSF RBI Cyber Security Framework / Master Directions RBI cyber-security requirements and directions set...
      India
      Regulation
      		 vLatest View →
      SEBI-CSCRF SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor...
      India
      Regulation
      		 vLatest View →
      SOC2 SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting...
      AICPA
      Audit Framework
      		 vLatest View →
      CIS-V8 CIS Controls CIS Controls are a prioritized set of cybersecurit...
      CIS
      Best Practice
      		 vv8 View →
      HIPAA Health Insurance Portability and Accountability Act HIPAA is a U.S. federal law supported by implement...
      US
      Law
      		 vCurrent View →
      ISO27002 ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a...
      ISO
      Standard
      		 v2022 View →

      Parent Domain Context

      Governance Domain Baseline
      Domain Name:
      Third-Party & Supply Chain Security (TPR)
      Purpose:
      To manage the security and privacy risks associated with third-party vendors and partners.
      Scope:
      Enterprise
      View

      Compliance Requirements & Audit Crosswalk

      10 Specific Audit Clauses

      The following requirements dictate specific audit evidence criteria and testing steps mapped directly under this control.

      REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
      TPR-001-R001 TPRM Governance Framework The organization shall establish a Third... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R002 Program Scope The organization shall define a document... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R003 Third-Party Classification The organization shall establish a class... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R004 Roles & Responsibilities The organization shall clearly define an... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R005 Risk Governance The organization shall establish governa... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R006 Program Metrics The organization shall define and track... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R007 Executive Reporting The organization shall provide executive... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R008 Program Review The organization shall conduct periodic... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R009 Program Compliance The organization shall ensure the TPRM p... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
      TPR-001-R010 Continuous Improvement The organization shall establish a conti... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗