BLOG

The most significant single-year shift in breach data in the history of the Verizon Data Breach Investigations Report happened between 2024 and 2025: third-party involvement in breaches doubled from 15% to 30%. In a single year, the proportion of breaches that entered organizations through a vendor, supplier, or service provider went from one in seven to nearly one in three.

For Canadian organizations, the implications arrive in multiple forms simultaneously. The IBM 2025 Cost of a Data Breach Report places the average Canadian breach cost at CA$6.98 million. A supply-chain breach costs an average of CA$4.91 million and takes 267 days to identify and contain, the longest lifecycle of any breach vector tracked. And with the median disclosure delay from vendor-side breaches sitting at 73 days, organizations are routinely learning about third-party compromises weeks after the exposure has already occurred.

Supplier risk management, the systematic process of identifying, assessing, monitoring, and mitigating cybersecurity risk introduced by vendors, suppliers, and service providers, aligns closely with modern Cybersecurity Advisory Services that help organizations build sustainable third-party governance programs.

What is supplier risk management in a cybersecurity context?

Cybersecurity supplier risk management (also referred to as third-party risk management, or TPRM) is the ongoing process by which an organization identifies, assesses, monitors, and manages the cybersecurity risks introduced by its vendor and partner ecosystem.

A mature TPRM program operates across the full vendor lifecycle:

1. Pre-engagement due diligence; assessing a prospective vendor’s security posture before signing a contract, using questionnaires, security ratings, certifications, and contractual requirements as the assessment mechanism
2. Contract and SLA requirements; embedding cybersecurity obligations into vendor agreements: minimum security standards, incident notification timelines, right-to-audit clauses, data handling requirements, and sub-processor restrictions
3. Ongoing monitoring; maintaining visibility into vendor security posture between annual reviews, using continuous monitoring tools, threat intelligence, and periodic reassessments
4. Incident notification management; defining and enforcing the timelines within which vendors must notify you of security incidents affecting your data or systems
5. Offboarding; ensuring that vendor access is revoked, data is returned or destroyed, and credential and integration cleanup is completed when a vendor relationship ends

Most Canadian organizations currently operate somewhere between stages one and two of this lifecycle, conducting due diligence at contract time and hoping the vendor’s security posture does not deteriorate thereafter. Many organizations begin by performing a formal cybersecurity posture assessment to establish a baseline of both internal and third-party exposure. The threat landscape has made that approach insufficient.

How Canadian regulators view third-party cyber liability

The Canadian regulatory environment leaves no ambiguity on organizational accountability for third-party data handling:

Under PIPEDA’s Accountability Principle, an organization that transfers personal information to a third party for processing remains accountable for protecting that information and must use contractual means to ensure comparable protection. This accountability does not transfer with the data, it stays with the organization that collected it. When a vendor breach exposes your customers’ personal information, PIPEDA’s breach notification obligations apply to your organization.

Quebec Law 25 imposes specific requirements on organizations using service providers that process personal information on their behalf, including contractual confidentiality obligations and privacy impact assessments for certain technology deployments. Penalties reach CA$25 million or 4% of worldwide turnover.

Bill C-8 introduces mandatory supply-chain risk management for designated operators in critical infrastructure sectors, they must actively mitigate third-party and supply-chain cybersecurity risks as a core program requirement. For organizations that supply to those sectors, that obligation flows downstream through procurement requirements.

OSFI’s B-13 Guideline requires federally regulated financial institutions to manage technology and cyber risk across their third-party relationships. Organizations preparing for these requirements often benefit from a structured compliance readiness assessment before engaging critical suppliers, with board-level oversight of significant outsourcing arrangements. For organizations supplying services to Canadian banks and financial institutions, B-13 is the benchmark their clients will hold them to.

The 4 tiers of supplier risk: how to categorize your vendor ecosystem

Not all vendors require the same level of security. A tiered approach allocates your assessment resources proportionally to the risk each vendor relationship represents and supports a broader cyber risk management strategy across the organization:

What to include in a vendor cybersecurity assessment

A comprehensive cybersecurity assessment for Tier 1 and Tier 2 suppliers should cover, at minimum :

• Security certifications and frameworks, does the vendor hold SOC 2 Type II, ISO 27001, or equivalent? Are certifications current and from a recognized auditor?
• Incident history and notification practices, has the vendor experienced a reportable breach in the last 24 months? What is their incident notification timeline and process?
• Access controls, how does the vendor manage privileged access? Is MFA enforced? How are credentials managed and rotated?
• Data handling, where is data stored geographically? Who has access to it? What are the retention and deletion practices? How is data protected in transit and at rest?
• Sub-processor management, does the vendor use sub-processors to fulfill your contract? What security requirements does it impose on them?
• Business continuity and incident response, does the vendor have a tested incident response plan and business continuity program?
• Vulnerability management, how frequently does the vendor patch systems? Is there a documented vulnerability disclosure and remediation process?
• Right to audit, does your contract include the right to audit the vendor’s security controls or require provision of independent audit results?

Moving from annual reviews to continuous supplier monitoring

The traditional TPRM model, an annual questionnaire sent to vendors, reviewed by procurement, filed until next year, was designed for a threat landscape that no longer exists. The median vendor breach disclosure delay of 73 days means that between the annual questionnaire and your next review, a vendor can be compromised, exploited, and remediated without you knowing. Or not remediated.

2026 is the year that leading Canadian organizations are moving from periodic assessment to continuous monitoring. The practical components of continuous supplier monitoring include:

1. Security ratings platforms, tools that continuously assess vendors’ externally observable security posture (exposed vulnerabilities, certificate management, dark web presence, DNS health) without requiring vendor participation. These provide ongoing signals between formal assessments.
2. Threat intelligence integration, monitoring threat feeds for indicators of compromise associated with your key vendors, enabling you to detect a vendor incident from threat intelligence data before the vendor notifies you.
3. Contractual notification obligations, requiring Tier 1 and Tier 2 vendors to notify you within a defined window (24 to 72 hours) of any security incident that may affect your data or systems, with penalties for non-compliance.
4. Periodic reassessment triggers, conducting out-of-cycle reassessments when a vendor undergoes significant changes: new ownership, major technology changes, public reports of a security incident, or changes to the services they provide under your contract.

Supplier risk management checklist for Canadian organizations

Use this framework to assess the maturity of your current program:

• Complete vendor inventory, do you have a complete, current list of every vendor with access to your systems or data?
• Risk tiering, have you categorized vendors by the risk they represent?
• Tier 1 assessments completed, have Tier 1 vendors been assessed against a standardized security questionnaire within the last 12 months?
• Contractual data handling requirements, do vendor contracts include minimum security standards, incident notification timelines, and data handling obligations?
• Right-to-audit clauses, are Tier 1 and Tier 2 contracts protected by audit rights or requirements to provide independent certification?
• Sub-processor visibility, do you know which sub-processors your Tier 1 vendors use to fulfill your contract?
• Notification SLAs enforced, have you tested whether vendors actually notify you within contractual timelines?
• Offboarding process, is there a documented process for revoking vendor access and recovering data when a vendor relationship ends?
• Concentration risk identified, have you identified vendors whose compromise would create disproportionate operational or data risk?
• Continuous monitoring in place, are you monitoring key vendors’ security posture between formal assessments?

What is the difference between TPRM and vendor management?

Vendor management covers the commercial and operational aspects of supplier relationships: contract terms, pricing, service delivery, and performance management. Third-party risk management focuses specifically on the risks those relationships introduce to the organization, cybersecurity, data privacy, operational resilience, and regulatory compliance. In practice, the two functions should operate together: cybersecurity requirements should be embedded in vendor contracts from the first negotiation, and TPRM findings should inform vendor management decisions including contract renewal and termination.

How many vendors should I assess in a supplier risk program?

Start with a complete inventory, then prioritize by tier. The goal is not to assess every vendor to the same depth, it is to apply appropriate scrutiny to vendors whose compromise would have material impact. Most Canadian SMBs and mid-market organizations have between 5 and 20 vendors that warrant a full Tier 1 assessment. Completing those assessments is more valuable than conducting shallow assessments of every vendor on the list.

Does my cyber insurance require supplier risk management?

Increasingly yes. Cyber insurers are expanding their security control requirements to include third-party risk management practices, particularly for organizations that rely heavily on managed service providers or cloud infrastructure. Some insurers now require evidence of vendor security assessments as a condition of coverage or pricing. Review your policy application questions carefully, representations about your security practices, including third-party controls, form the basis for coverage, and material inaccuracies can create grounds for claim denial.

What happens if a supplier breach exposes my customers’ data under PIPEDA?

Under PIPEDA’s Accountability Principle, you remain responsible for protecting personal information you transfer to a third party for processing. If a vendor breach exposes your customers’ personal information and there is a real risk of significant harm, you are required to notify affected individuals and report the breach to the Office of the Privacy Commissioner of Canada. The fact that the breach originated at a vendor does not transfer the regulatory obligation. Quebec Law 25 has similar accountability provisions with stricter notification timelines and higher penalties.