Requirement Details
The Third-Party Management Topical Requirement, released in draft form in March 2025 and open for public comment until April 20, 2025, addresses the critical need for consistent auditing of vendor and third-party relationships. This requirement provides standards for evaluating third-party risk management programs, including vendor selection processes, due diligence procedures, ongoing monitoring activities, and performance management. It covers the entire vendor lifecycle from onboarding through termination, with special focus on critical vendors, concentration risks, fourth-party risks, and supply chain dependencies. The requirement emphasizes the importance of assessing data privacy, security controls, business continuity capabilities, and regulatory compliance of third parties.