GRCLibrary.ai

Standard

Third-Party and Supply Chain Risk Standard

This standard defines the framework, methodology, and control requirements for identifying, assessing, treating, and monitoring risks arising from third-party relationships and supply chain dependencies. It is the master third-party and supply-chain risk standard for the library: the enterprise risk-management lens, the lifecycle expectations, and the contracting controls are all defined here. Operational procedures in the supply-chain domain implement the lifecycle steps; this standard governs them.

Type
Standard
Version
1.1.20
Date
2026-11-07
Owner
Chief Risk Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Risk Management: Third-Party and Supply Chain
Review frequency
Annual and upon material supply chain change, significant third-party incident, or regulatory update
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Risk classification
  • 4. Risk assessment requirements
  • 5. Contract requirements
  • 6. Ongoing monitoring
  • 7. Supply chain continuity risk
  • 8. Incident and breach management
  • 9. Offboarding and contract termination
  • 10. Reporting
  • 11. Framework alignment

Frameworks it maps to

Related documents