Extend Security Governance to Every Vendor and Partner
Modern organisations depend on an increasingly complex ecosystem of suppliers, technology providers and business partners. Those relationships can introduce access to sensitive information, critical systems and essential services, extending cyber risk beyond the boundaries of your organisation. Effective third-party risk management provides the visibility and assurance needed to understand that exposure and make informed decisions about how it is managed.
Meridian Cyber helps organisations establish and mature third-party cyber risk programs across the supplier lifecycle. We assess risk according to the criticality of each relationship, strengthen security requirements through procurement and contracting, and provide ongoing assurance as suppliers, services and dependencies change. Our approach can be aligned to ISO/IEC 27001, NIST SP 800-161 and applicable regulatory requirements, providing a consistent basis for managing third-party risk across the organisation.
- Understand the cyber risk introduced by critical suppliers, service providers and business partners.
- Apply proportionate assurance based on access, information sensitivity, service criticality and business dependency.
- Embed security requirements throughout procurement, contracting, onboarding and supplier management.
- Maintain ongoing assurance and readiness to respond when third-party security incidents occur.
Identify
Map critical suppliers, services, system access and data dependencies to establish a clear view of third-party exposure across the organisation.
Govern
Embed security requirements across procurement, contracts and supplier management to establish clear expectations, accountability and consistent oversight throughout the relationship.
Assess
Assess third parties by criticality, access, data exposure and security posture to determine risk, assurance requirements and treatment priorities.
Respond
Define escalation, notification and response requirements for supplier incidents, enabling coordinated action to contain impact and maintain business continuity.
Our Third-Party Risk
Services
Meridian Cyber helps organisations understand and manage cyber risk across their supply chain, from initial due diligence and contracting through to ongoing assurance. Our services establish a consistent approach to assessing suppliers, setting security expectations and maintaining visibility of third-party risk over time.
Third-Party Risk Register
Establish a central view of suppliers, service providers and business partners, including their criticality, system access, data exposure and assurance status. The register provides a consistent basis for risk ownership, review and reporting across the organisation.
Vendor Due Diligence Assessment
Assess prospective and existing suppliers against risk-based security requirements, drawing on evidence including ISO/IEC 27001 certification, SOC 2 reports, penetration testing and security questionnaires. Findings identify areas of concern and provide clear recommendations for remediation or risk treatment.
Contract Security Requirements
Define security requirements for supplier agreements, covering areas including access control, data protection, incident notification, audit rights, subcontracting and service continuity. Requirements are tailored to the risk and criticality of the service being provided.
Third-Party Risk Management Policy
Establish the governance required to manage third-party cyber risk consistently across the organisation. The policy defines supplier risk tiers, due diligence requirements, assurance activities, escalation criteria and accountability throughout the third-party lifecycle.
Vendor Onboarding & Offboarding Checklist
Establish consistent security requirements at the beginning and end of every supplier relationship, covering due diligence, access, data handling, contractual obligations and transition. The checklist helps ensure risk is addressed before access is granted and closed out when the relationship ends.
Vendor Incident Response Runbook
Define how third-party security incidents are escalated and managed, including notification triggers, evidence requirements, response responsibilities and contractual obligations. The runbook supports a coordinated response between your organisation and the supplier when an incident occurs.