Resilience Spine
    Cross-cutting — Third- & Nth-Party Risk

    The platform-of-platforms.

    Modern financial services run on stacks four and five vendors deep. The TPRM pack makes that graph visible — diligence, contracts, concentration, continuous monitoring and tested exit-plans — and routes vendor-originated incidents into the DORA, NIS2, OSFI E-23 and APRA CPS 230 reporting flows already wired into the platform.

    Domains

    Inherent-risk tiering

    Criticality, data-sensitivity, regulatory-impact and concentration weights driving diligence depth.

    Diligence evidence

    SOC 2 / ISAE 3402, ISO 27001, financial viability, sanction / adverse-media, ESG and modern-slavery attestations.

    Contract & RTS terms

    DORA RTS on sub-contracting clauses, OSFI B-10 contract provisions, exit-rights, audit-rights, sub-processor consent.

    Fourth- and nth-party graph

    Sub-processor enumeration, hyperscaler concentration, geographic-residency map.

    Continuous monitoring

    Performance KPIs, SLA breach evidence, security signals, attestation refresh cadence.

    Exit-plan attestation

    Documented, tested exit-plan with substitutability scoring and stressed-transition timing.

    Concentration scoring

    Vendor, geography, hyperscaler and sub-processor concentration — institution-level and book-of-business level.

    Incident & near-miss

    Vendor-originated incident pipeline routed into NIS2 / DORA / OSFI E-23 reporting flows.

    Anchor sets

    EU
    DORA Articles 28–30 · RTS on sub-contracting (final) · EBA Guidelines on Outsourcing GL/2019/02
    UK
    PRA SS2/21 Outsourcing & third-party risk · FCA SYSC 8 · CTP regime
    United States
    FRB SR 23-4 / OCC / FDIC interagency third-party guidance · OCC Heightened Standards
    Canada
    OSFI B-10 Third-Party Risk Management · OSFI E-21 Operational Resilience
    Australia
    APRA CPS 230 Operational Risk Management · CPG 230
    Asia-Pacific
    MAS TRM Guidelines · MAS Outsourcing · HKMA SA-2 / TM-G-1 · JFSA outsourcing supervisory guidelines