Third-party risk is usually managed by sending a spreadsheet of questions to companies who answer them identically, filing the responses, and repeating annually. It produces an audit trail and very little security. The alternative is narrower and more useful: stop assessing vendors in the abstract and start inventorying what each one can actually reach.

Build an access inventory

For every external service, record what data it holds, what systems it connects to, what permissions those connections carry, and who inside your organisation owns the relationship. Most teams discover integrations nobody remembers approving — a defunct analytics tool with read access to production, a contractor's automation still holding a token, a marketing app with full mailbox permissions.

OAuth grants are the blind spot

A single "sign in with" approval can grant a third party persistent access to mail, files, or calendars that survives password changes. Review granted application permissions across your identity provider and productivity suite, revoke what is unused, and restrict who can approve new grants. This is frequently the highest-value hour in the entire exercise.

Ask the questions that have consequences

  • Where is our data stored, and who else can access it?
  • What are your breach notification timelines, and are they in the contract?
  • What happens to our data when we leave, and how is deletion evidenced?
  • Do you subcontract processing, and to whom?

Offboarding is where risk persists

Cancelling a subscription does not revoke an API token, remove a webhook, or delete data. A proper offboarding revokes credentials and grants, removes integrations from your side, confirms deletion in writing, and closes any accounts the vendor created in your environment. Without it, discontinued vendors keep standing access indefinitely.

Match effort to consequence

A design tool holding no customer data does not deserve the same scrutiny as a service with production database access. Tier by what a compromise of that vendor would mean for you, then spend your limited attention on the top tier and keep the rest to an inventory entry and a review date.