Glossary term
TPRM
Also: Third-Party Risk Management
Discipline and tool category for governing risks from external providers (SaaS, cloud, outsourcing, advisory). Mandatory under DORA Art. 28-30 for financial entities and NIS2 Art. 21 (d) for essential/important entities.
Core processes: onboarding review (eligibility, compliance, security posture), continuous monitoring, risk assessment per contract (critical/important/supporting), contract clauses, exit planning, concentration risk steering, audit trail.
Tools: stand-alone leaders: OneTrust GRC, ServiceNow GRC, MetricStream, ProcessUnity, Prevalent, Aravo, BitSight, SecurityScorecard, Panorays. Differentiation: GRC platforms with TPRM module vs stand-alone TPRM with GRC integrations.
In practice
Practice: many companies underestimate the depth of DORA Art. 28-30. Information register, mandatory clauses (Art. 30), tested exit strategy, concentration-risk analysis are all audit-bound. TPRM tools alone are not enough; per-contract decision documentation (decision memo) is a mandatory companion artefact.
Related terms
DORA
EU regulation on digital operational resilience in the financial sector. Directly applicable since 17 January 2025. Five pillars: ICT risk management, incident management, resilience testing including TLPT, third-party governance, information sharing.
NIS2
EU directive on network and information security. Replaces NIS1, widens scope to around 30,000 German companies in 18 sectors, introduces personal management body liability, sets ten minimum cybersecurity measures under Article 21.
Supply Chain Risk
Risks from the software and hardware supply chain: compromised open-source packages, build-pipeline attacks, updates with backdoors, sub-suppliers without audit trail. Mandatory under NIS2 Art. 21 (d) and DORA Art. 28 (sub-outsourcing).
ICT Third-Party Risk
Sammelbegriff für Risiken aus dem Einsatz externer ICT-Lieferanten: Cloud-Provider, SaaS-Anbieter, MSPs, MSSPs. Unter DORA Art. 28 explizit reguliert; jeder kritische Lieferant muss in einem Register stehen und einer dokumentierten Eignungsprüfung folgen.
TCO modelling
A structured estimate of the full lifetime cost of a vendor decision, including licence, implementation, integration, operation, change management and exit cost. List price is usually 20 to 40 percent of real TCO; modelling exposes the rest.
TIA
Assessment of the protection level in the recipient country for data transfers to third countries after Schrems II. Required under SCC, BCR, and Art. 49 derogations. Output: decision whether the transfer may proceed without, with, or not at all.
TISAX
Audit standard and exchange platform of the German automotive association (VDA) for information security. ISA catalogue is the assessment grid, ENX operates the platform.
Trade-off analysis
The explicit documentation of what each option gives up to deliver its strengths. Good trade-off analysis makes the cost of the winning option as visible as its benefits, and shows how robust the choice is to changes in weights.