A third-party risk management (TPRM) policy should govern the full relationship lifecycle: plan the engagement, assess and select the provider, negotiate safeguards, monitor the relationship, and manage termination. Use the template below as a starting point, then adapt it to your jurisdiction, sector, contracts, risk appetite, and operating model. It is not a regulator-approved universal form.
Who this template is for—and what it is not
This template is intended for organizations that rely on outside providers, including vendors, service providers, technology suppliers, and other third parties. It is a governance framework to customize, not legal advice or a substitute for sector-specific requirements.
The most complete lifecycle reference reflected here is U.S. interagency guidance for banking organizations. It is useful as a structured model, but its audience is the banking sector; organizations in other sectors should map policy requirements to their own laws, regulations, contracts, risk appetite, and operating model. The OCC’s community-bank guide is voluntary, and its relevance depends on an institution’s size, complexity, risk profile, and relationship. Federal Reserve SR 23-4 and the OCC community-bank guide provide sector-specific context.
As of the OCC’s September 11, 2026 announcement and the September 15, 2026 Federal Register publication, proposed interagency guidance to revise and replace the existing guidance was open for comment, not a final replacement. Check the OCC announcement and Federal Register notice for current status before relying on it.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Third-party risk management policy template
Copy and adapt the following provisions. Replace bracketed text, assign named roles, and align approval levels and records with your governance structure.
1. Purpose and policy statement
Purpose. This policy establishes how [Organization] identifies, assesses, approves, contracts with, monitors, and exits relationships with third parties. Its purpose is to manage risks in a manner proportionate to the importance of the activity, the provider’s access and dependencies, and the potential consequences of disruption or failure.
Policy statement. No covered relationship may be committed to or materially changed until required planning, risk assessment, approvals, and contract review are complete. Each relationship must have an accountable business owner, a documented risk tier, appropriate controls and contractual protections, ongoing oversight, and an exit approach. Exceptions and accepted residual risks must be documented and approved by an authorized role.
2. Scope and related policies
This policy applies to [employees, business units, subsidiaries, and other covered entities] and to third parties that provide services, systems, products, data processing, operational support, or other capabilities to or on behalf of [Organization]. It covers new engagements, renewals, material changes in scope or access, and termination.
Free tools Windows power users keep installed
One-click scans. No signup required.
[List exclusions, if any, and the rationale and controls that apply to them.] Coordinate this policy with procurement, information security, privacy, business continuity, records retention, incident response, compliance, and contract-management policies. Where requirements conflict, [identify escalation and precedence process].
3. Definitions
- Third party: [Define the external person or organization covered, including relevant subcontractors or intermediaries.]
- Relationship owner: The person accountable for the business purpose, performance oversight, and lifecycle records for a relationship.
- Critical or important activity: An activity that [define using the organization’s criteria for customer, operational, financial, legal, safety, or other material impact].
- Residual risk: Risk remaining after planned or existing controls are considered.
- Subcontractor: A provider engaged by a third party to perform part of the service or support the relationship.
4. Governance and responsibilities
Assign responsibilities to roles that exist in your organization; avoid importing another sector’s governance structure without review.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
- Board or governing body: [Set oversight responsibilities for material third-party risk, where appropriate.]
- Executive management: [Own program implementation, approve risk appetite and authorities, and resolve significant escalations.]
- Business relationship owner: Define the need, maintain the relationship record, coordinate assessment and approvals, monitor performance and changes, and lead exit planning.
- Procurement: Coordinate sourcing, vendor onboarding, commercial review, and renewal controls.
- Legal: Review contract terms, regulatory and contractual obligations, and enforceability of remedies and exit rights.
- Information security and technology: Assess security, systems access, technical controls, resilience, and technology dependencies.
- Privacy and compliance: Review personal-data processing, legal and regulatory obligations, and relevant compliance controls.
- Business continuity or resilience: Review continuity arrangements and disruption scenarios where relevant.
- Independent review: [Specify proportionate independent testing or review of the program and material relationships.]
Maintain a current inventory of covered relationships. For each record, include at minimum the provider, service and business purpose, owner, risk tier, key data and access, approval status, contract and renewal dates, assessment evidence, monitoring actions, material incidents, and exit status.
5. Risk tiering and approval
Before commitment, classify each relationship using documented criteria. Consider the impact and criticality of the activity; data sensitivity and system access; customer-facing activity; substitutability; provider resilience; concentration and dependencies; geography; subcontractors; and the consequences of disruption or failure.
Recommended Free Tools
[Define tier names and approval authorities.] Record why the assigned tier is appropriate and how it changes required due diligence, contract review, monitoring cadence, escalation, and exit planning. A low tier should not mean no controls; it should mean controls proportionate to the documented risk.
Approval must occur before commitment by [authorized role or committee]. Material findings, exceptions, or proposed risk acceptance must be escalated to [role or committee]. Only [authorized role] may accept residual risk, and the record must state the risk, rationale, mitigations, owner, approval date, and any review or expiry date.
6. Lifecycle requirements
Stage A: Planning
Before selecting a provider, the relationship owner documents the business purpose, expected benefits, alternatives, data and system access, dependencies, and consequences if the provider cannot perform. Determine whether the proposed activity is critical or important under the organization’s criteria. Identify applicable legal, regulatory, contractual, security, privacy, continuity, and records requirements.
Required record: [Business case or planning record], including the proposed scope, alternatives considered, initial risk view, dependencies, and decision owner.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Escalate when: the activity may be critical, the service creates material concentration or lock-in, the provider will have sensitive data or privileged access, or the organization cannot identify a workable alternative or continuity approach.
Stage B: Due diligence and selection
Assess each proposed provider in proportion to relationship risk and complexity. Evidence must cover the actual service, locations, systems, data, and subcontracting scope—not merely the provider in general. Depending on the relationship, review:
- Strategy, business objectives, experience, and ability to perform the proposed service.
- Legal and regulatory compliance relevant to the service and the organization.
- Financial condition and other indicators that could affect continuity.
- Key personnel and governance for the service.
- Risk management, internal controls, information security, and information systems.
- Operational resilience, continuity arrangements, and recovery capabilities.
- Subcontractors, dependencies, concentration, geographic exposure, and other relationship-specific risks.
Set evidence requirements by tier, including acceptable evidence types, scope, age, assurance, and reviewer. When evidence is missing, stale, limited, or out of scope, record the limitation, understand the risk, and consider alternatives or mitigations before approval. Do not treat an unverified assertion as equivalent to evidence.
Required record: [Assessment and selection record] showing evidence reviewed, scope and date, findings, limitations, mitigations, decision, and approvers.
Escalate when: evidence does not cover material systems or services, significant findings remain unresolved, or the provider’s condition, control environment, or dependencies create risk beyond authorized appetite.
Stage C: Contract negotiation
Translate material risks and obligations into clear, enforceable contract responsibilities. The terms required depend on the service, applicable rules, and negotiating context; have counsel determine what is appropriate. Address, where relevant:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
- Service scope, performance measures, service levels, and remedies for failure.
- Access to relevant information and records, and audit or examination rights where appropriate.
- Security, privacy, data handling, retention, return, and deletion obligations.
- Incident, breach, complaint, and material-change notification and cooperation.
- Subcontractor use, oversight, flow-down requirements, and visibility.
- Business continuity, resilience, recovery, and testing expectations.
- Regulatory cooperation and access rights where applicable.
- Termination rights, transition support, data portability, and treatment of outstanding obligations.
Required record: [Executed contract and clause review or exception log], linked to the approved risk assessment.
Escalate when: a material risk has no enforceable control or remedy, the contract restricts needed oversight, or a clause departs from policy without authorized approval.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Stage D: Ongoing monitoring
Monitor the provider throughout the relationship. The depth and cadence should track tier, changing risk, and service performance. Review service levels, incidents and complaints, control evidence, compliance, financial or business changes, subcontractor reliance, and continuity or resilience. Reassess when scope, access, data, ownership, geography, subcontractors, or the provider’s condition materially changes.
Record findings, accountable owners, corrective actions, target dates, closure evidence, and any risk acceptance. Escalate repeated service failures, material incidents, overdue remediation, adverse changes, or risk beyond appetite through [defined route and timeframe].
Required record: [Monitoring log or review record], including review date and scope, evidence, findings, follow-up, escalation, and next review date.
Stage E: Termination and transition
Plan for scheduled expiry, termination for cause, provider failure, and other unexpected exits. The plan should address transition or replacement, service continuity, return or deletion of data, access revocation, outstanding obligations, and record retention under applicable contracts and law. For critical relationships, define an exit approach before engagement and revisit it as dependencies change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Required record: [Exit plan and closure record], including decision authority, transition owner, milestones, data disposition, access removal, unresolved obligations, and retained records.
Escalate when: a provider cannot support an orderly transition, data cannot be returned or deleted as expected, access remains active, or continuity is at risk.
7. ICT and cyber supply-chain supplement
For information and communications technology (ICT) suppliers and dependencies, add technology-specific prompts to the broader lifecycle process. NIST SP 1326, published July 8, 2026, is a quick-start guide aligned with SP 800-161 Rev. 1. It identifies five due-diligence assessment components:
- Foreign Ownership, Control, or Influence (FOCI).
- Provenance.
- Resilience.
- Foundational Cyber Practices.
- Supply Chain Tiers.
Use these components to identify relevant questions and evidence for ICT suppliers; they supplement rather than replace planning, contracting, monitoring, and termination controls. See NIST SP 1326.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute8. Exceptions, records, reporting, and review
Document policy exceptions before they take effect where practicable. Each exception must identify the requirement, rationale, affected relationship, compensating controls, approving authority, accountable owner, and expiry or review date. Maintain lifecycle evidence and decisions in [approved repository] for the period required by law, contract, and internal retention rules.
[Define reporting frequency and recipients] for inventory coverage, upcoming renewals, significant findings, overdue remediation, material incidents, accepted risks, and termination status. Review this policy and its implementation [at a defined interval] and when material changes in law, operating model, risk profile, or third-party dependencies warrant it. The procedures and independent review should be proportionate to the organization’s size, complexity, profile, and third-party risks.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to put the template into use
- Set the boundary. Identify covered entities, relationships, exclusions, and connected policies; have legal and compliance reviewers check the scope.
- Assign decision rights. Name relationship owners, reviewers, approvers, and risk-acceptance authorities. Establish escalation paths before onboarding begins.
- Define tiers and evidence rules. Specify the criteria, approvals, diligence depth, monitoring cadence, and evidence freshness for each tier.
- Build the records and controls. Create the relationship inventory, assessment form, approval record, contract checklist, monitoring log, exception record, and exit plan.
- Apply the lifecycle to active relationships. Prioritize higher-risk relationships and upcoming renewals, identify gaps, assign mitigations, and document decisions.
- Review and improve. Use incidents, control findings, changes in provider dependencies, and exit experience to revise procedures and policy thresholds.
Common implementation mistakes to avoid
- Using a questionnaire as the whole program: A questionnaire cannot replace planning, contract protections, monitoring, or exit planning.
- Applying the same diligence to every provider: Scale review to impact and complexity, while recording the reason for the tier.
- Accepting broad or stale evidence: Confirm that material evidence matches the actual service and scope, and document gaps and mitigations.
- Leaving responsibilities implicit: Assign a relationship owner and named escalation and approval roles.
- Leaving exit until the end: Identify transition and data-disposition needs early, especially where dependencies or substitutability are concerns.
- Treating proposed guidance as final: Confirm the status and applicability of relevant rules and guidance before relying on them.
Or skip the browser setup
If you need clean screenshots of policy pages or vendor evidence in a browser, ScreenshotNeo offers a one-request API:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webp
Quick Recap
See the ScreenshotNeo documentation for request options. ScreenshotNeo accepts cookie and consent banners and removes 60+ known consent platforms, newsletter popups, and chat widgets before capture; each step can be turned off. Bot checks, blank pages, timeouts, failed loads, and cache hits cost nothing, and response headers identify the page verdict and billing status. Its MCP server supports AI agents through tools for screenshots, page information, and PDF capture. The free plan includes 1,000 shots per month with no card; paid plans start at $5 for 3,000 shots. Learn more at ScreenshotNeo, or sign up free for 1,000 screenshots a month with no card.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
