Why regulators care
Banks, NBFCs, insurers and market intermediaries rely on technology vendors, cloud providers and outsourced services. Regulators are clear that outsourcing an activity does not outsource accountability. Several high-profile incidents have started at a supplier.
A risk-tiered process
1. Build a complete inventory
List every third party with access to your systems, data or critical processes — including SaaS tools teams signed up for directly.
2. Tier by inherent risk
Consider data sensitivity, system access, criticality to operations and substitutability.
| Tier | Example | Assessment depth |
|---|---|---|
| Critical | Core banking provider, cloud host | Full assessment, on-site or evidence review, annual |
| High | Payroll processor | Detailed questionnaire and evidence |
| Moderate | Marketing SaaS without sensitive data | Light questionnaire |
| Low | Office supplies | Basic onboarding checks |
3. Due diligence proportional to tier
Use recognised evidence — ISO 27001 certificates, SOC 2 Type II reports, penetration test summaries — before sending long custom questionnaires.
4. Contract for security
Key clauses:
- Security requirements and right to audit
- Breach notification timelines that let you meet CERT-In and DPDP obligations
- Data location and return or deletion on exit
- Sub-contractor approval
- Regulator access where required
5. Monitor continuously
Track certificate expiry, incidents, ownership changes and external security ratings for critical vendors.
6. Plan the exit
For critical services, document how you would transition away — data portability, timelines and alternatives.
Common gaps
- Inventory limited to procurement records, missing shadow SaaS
- Assessments done at onboarding and never repeated
- Contracts without breach notification timelines
- No owner for the relationship's security risk
Key takeaways
- Outsourcing an activity does not outsource accountability.
- Tier vendors by inherent risk and assess proportionately.
- Contract for notification timelines, audit rights and exit.
Frequently asked questions
How often should critical vendors be reassessed?
At least annually, and whenever there is a significant change such as an incident, acquisition or new data access.
Are certifications enough evidence?
They are a strong starting point. Check the scope covers the services you use and review any exceptions or findings in reports such as SOC 2.
What about fourth parties?
Require critical vendors to disclose and manage their own key sub-contractors, and to seek your approval for changes that affect your data.
You can delegate the work, but not the risk.
Our GRC practice designs third-party risk programmes for regulated entities.
