Fourth-party risk is risk reaching your organization through a supplier your vendor relies on. If your payroll provider uses a separate hosting company to run your payroll service, that hosting company is a fourth-party dependency from your perspective. An outage or security problem there can affect you even though you did not contract with it directly. Start with dependencies that support important services or handle sensitive data; your vendor’s unrelated purchases are not equally relevant.
Read more: What Should We Ask a Vendor About Its Fourth-Party Dependencies?.
