Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Fourth-Party and Supply Chain Risk
The chain behind the supplier
Your payroll provider runs on a cloud platform, uses an email provider and builds on open-source libraries. Your data and services depend on all of them, though you only contracted the first. These are fourth parties (and beyond), and the 2026 CISM outline names them explicitly under the management of external services.
Four kinds of supply chain risk
| Risk | What it looks like |
|---|---|
| Fourth-party exposure | Your data held by a supplier’s subcontractor you never vetted |
| Compromised products | Malicious code in a trusted update or library reaching many customers at once |
| Concentration | Many critical services depending on one cloud or one managed service provider |
| Supplier failure | Bankruptcy, a long outage or the exit of a key provider |
What you can do
You can’t audit every fourth party, but you can require your suppliers to manage theirs:
| Risk | Control |
|---|---|
| Unknown subcontractors | Disclosure and approval of material subcontractors; flow-down security clauses |
| Compromised software | SBOMs, trusted sources, signed updates, monitoring of vendor advisories, segmentation |
| Concentration | Map dependencies; diversify, or plan alternatives for critical services |
| Supplier failure | Continuity requirements, source code escrow, exit plans |
Signed updates can still be malicious if the vendor itself is compromised, so layer detection and segmentation too. Diversifying providers reduces concentration risk, but adds complexity and cost; it’s a risk decision like any other.
Example. A widely used file-transfer product is compromised and data is stolen from hundreds of organisations. A company that had mapped its suppliers’ use of that product knew within a day which three suppliers held its data, asked each for an incident report and notified its regulator on time.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Your supplier’s subcontractor | A fourth party |
| Best way to manage fourth-party risk | Require suppliers to manage and disclose their subcontractors |
| Many critical services depend on one provider | Concentration risk |
| Control for compromised software components | An SBOM and dependency monitoring |
| Planning for a critical supplier failing | Continuity and exit planning |
In short
- Fourth parties are your suppliers' suppliers; your data and services may depend on companies you've never contracted.
- Supply chain attacks compromise one trusted supplier or software product to reach many victims.
- Concentration risk arises when many critical services depend on the same provider.
- Controls: require suppliers to disclose and manage their subcontractors, flow down security requirements, and approve material changes.
- For software, use SBOMs, trusted sources, signed updates and monitoring of vendor advisories.
- Plan for supplier failure: continuity arrangements, alternatives and exit plans for critical dependencies.
Exam traps
- Assessing only direct suppliers leaves the wider chain invisible.
- Signed, trusted updates can still be malicious if the vendor itself is compromised; layer detection too.
- Diversifying providers reduces concentration risk but adds complexity and cost.
- You can't audit every fourth party; require your suppliers to manage theirs.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The chain behind the supplier