Overview: Fourth-Party Risk

Quick Definition

A fourth-party risk is the cybersecurity threat posed by vendors or service providers that work with an organization's direct third-party vendors. While third-party risk involves direct business partners, fourth-party risk extends the threat landscape to include the suppliers, subcontractors, and service providers that those direct partners rely upon.

Organizations typically have contracts and security agreements with their immediate vendors, but often lack visibility into or control over the security practices of their vendors' vendors. This creates a blind spot where malicious actors can potentially infiltrate the supply chain through these indirect relationships.

Fourth-party risks can manifest in various ways, including data breaches that propagate through multiple vendor relationships, malware infections that spread across interconnected systems, or compliance violations that occur several steps removed from the primary organization. For example, a company's cloud provider might use a subcontractor for data center maintenance, and a security breach at that maintenance company could potentially compromise the organization's data.

Managing fourth-party risk requires organizations to implement comprehensive vendor risk management programs that include due diligence requirements for their direct vendors' security practices with their own suppliers, contractual obligations for supply chain security, and continuous monitoring of the extended vendor ecosystem.