Organizations often lack a clear view of the subcontractors and other downstream parties supporting their most critical vendors.
Why It Matters
Most TPRM programs are designed around direct contractual relationships. The service delivered by a third party, however, may depend on a deeper network of providers that store data, host applications, supply software, or support critical operations. Those fourth and deeper parties (often referred to as 4th or Nth parties) can affect the organization without appearing in its vendor inventory or participating directly in its assurance process.
“We just have so many problems from a fourth-party perspective of getting a good understanding of who all is involved, right? And some of our third parties are like, here have this report. It'll give you all the answers you need and some of it's so vague.” -- TPRM Leader commenting on their challenges with vendor assurance
The blind spot becomes more serious when assurance documentation is vague about subservice organizations, inherited controls, and shared responsibilities. A report may appear comprehensive while excluding the provider that operates an important part of the service. The TPRM team must then determine whether the dependency was assessed, carved out, or left unexamined.
What the Evidence Shows
- According to the 2025 Panorays CISO survey, only 3% of organizations had full insight across their entire supply chain
- In the World Economic Forum Global Cybersecurity Outlook 2026, 78% of CEOs of highly resilient organizations cited supply chain and third-party dependencies as the most significant challenge to further strengthening resilience.
- Require key vendors to disclose the downstream providers supporting material services and data flows.
- Determine whether those providers and their controls are included in the assurance scope, or any supporting evidence.
- Seek separate assurance when a material dependency is excluded.
- Require notification when significant subcontractors, platforms, or service dependencies change.
What TPRM Leaders Can Do
Organizations may outsource a service, but they still retain the risk created by the supply chain behind it. Visibility must extend far enough to understand who supports critical outcomes and where assurance stops.
Coming Up in the Next Blog in the Series
If you missed the first blog in the series, please check out it here. Be sure to follow HITRUST on LinkedIn and X to know when the next blog in the TPRM Top 10 series, Concentration Risk Turns Vendor Failures Into Enterprise Events, is posted.
*CHIME Digital Health Analytics. Third-Party Risk Management Assurance: Strategic Market Validation Survey. Commissioned by HITRUST. Ann Arbor, MI: College of Healthcare Information Management Executives, Digital Health Analytics 2026. In July 2026, HITRUST commissioned CHIME Digital Health Analytics to conduct a blinded market-validation survey of 102 qualified respondents from separate healthcare provider organizations with more than $1 billion in annual revenue. Respondents represented security and GRC leadership, TPRM ownership, procurement and vendor management, legal and contracting, and executive leadership. Every participating organization actively managed at least 200 third-party vendors, and 87% managed more than 500.