Optimized Third-Party Cyber Risk Management Programs

Manage risk, not spreadsheets. Identify and remediate cybersecurity risks inherent in third-party relationships, helping achieve compliance with regulations such as NYDFS, FARS, GDPR, etc.

Contact us
/en/services/cyber-risk/governance-advisory/third-party-cyber-risk-management service

Third parties can add great business value to your enterprise, but they also bring their own risks. When an incident affects your customers, it won’t matter if the source was a third party – your organization will be held accountable for the harm. With your reputation and revenue on the line, how are you managing third-party cyber risk? Do you fully understand the state of your third parties’ cybersecurity and resilience? How well are they protecting your confidential and highly sensitive information?

Kroll’s third-party cyber risk management (TPCRM) services deliver a multidirectional view of risk that supports defensible cybersecurity strategies and regulatory requirements. You benefit from our powerful blend of unique insight that only comes from in-house experience with managing third-party risk and handling more than 3,200 diverse cyber incidents every year with today’s most advanced technology, including Kroll’s CyberDetectER® and CyberClarity360™.

Importantly, all of Kroll’s TPCRM solutions are designed to be transparent and provide actionable remedies. Our pragmatic approach gives you the strategic foundation to ultimately improve and strengthen confidence in your vendor partnerships.

Third-Party Cyber Risk Management: Objective and Expert Guidance

Kroll’s vendor risk management services are designed to provide a comprehensive evaluation of the security risks that a third-party organization may present. Our core services are listed below:

CyberClarity360™ Third-Party Cyber Risk Management Platform

CyberClarity360™ is a sophisticated solution that helps organizations efficiently assess and confidently track the cybersecurity and resilience of their third parties. CyberClarity360 quantifies cyber risk by leveraging a transparent scoring and analysis system designed to deliver unique insights, drive informed risk-based decisions, and offer insight into often overlooked risk areas not only at control level detail, but also portfolio-wide.

Platform Overview

CyberClarity360 is a field-proven solution, trusted by some of the world’s largest organizations (including firms in the Fortune 50 and FTSE 100) to deliver key advantages for managing third-party cyber risk:

  • Increase Velocity and Reach

    Automate assessment collection, reaching more vendors in less time
  • Validate Responses

    Smart algorithms surface incomplete and inconsistent answers

  • Identify Compliance and Control Gaps

    Map assessment results against security and regulatory frameworks, e.g. NIST CSF and CIS, to identify control gaps
  • Generate and Track Remediation

    Tailored remediation advice and remediation validation capability
  • Real-Time Risk Monitoring

    Live dashboards and reporting capabilities, risk disposition and acceptance tracking


CyberDetectER® DarkWeb

By using CyberDetectER DarkWeb to monitor third-party data on the dark web, you can potentially understand exposures stemming from third parties, including professional services providers, vendors and suppliers.

For example, CyberDetectER DarkWeb discovered that several highly sensitive and privileged documents belonging to one of our clients, a Fortune 100 global financial services company, were being disclosed to public peer-to-peer (P2P) file-sharing networks. Kroll found the source to be a paralegal for one of the client’s outside law firms who was inadvertently disclosing this content while accessing free media on P2P networks. Had these files remained in the public domain, they could have lost their privileged classification and been open for discovery by opposing counsel, exposing much of the company’s legal strategy.

Strategic Program Advice

Kroll provides advisory services to assist CISOs and organizations with their cybersecurity strategy and program building. Kroll assists with leading setup and monitoring of your TPCRM program, risk committee meetings, providing security assessment remediation guidance, evaluating on-premise and cloud-based security solutions, data mapping, incident response planning, training and other third-party risk services.



Cybersecurity Program Assessment

Detailed assessment of the maturity level of the third party’s security program with an emphasis on the organization’s ability to defend against and respond to cybersecurity threats affecting its information assets and mitigate the risk of suffering a security breach. Kroll utilizes standard security frameworks such as NIST, CIS Controls™, ISO, etc. and focuses on regulatory requirements such as HIPAA, SEC, NY-DFS, GDPR, etc.

Penetration Testing

The goal of a penetration test is to attempt to gain access to corporate assets from the Internet, simulating a real-world attack. Internet reconnaissance is completed to identify publicly accessible information that may aid in the attack. Targeted phishing exercises are included as part of the testing. 

Vulnerability Testing

The goal of a vulnerability test is to determine if security vulnerabilities exist which may be exploitable by attackers. Kroll utilizes advanced vulnerability assessment tools to identify potential security vulnerabilities within the corporate environment.


Global Risk Management Expertise

Our end-to-end TPCRM solutions are powered by Kroll’s unrivaled expertise in cyber risk management and the frontline insights acquired by handling more than 1,000 cyber incidents per year. Enterprises benefit from our cyber and compliance expertise in regulations such as current European data protection laws, US HIPAA, PCI DSS, CASL and Hong Kong's DPO Principle 4, among others. Many of our risk professionals bring years of unique experience in a variety of industries as well as from their former service with law enforcement and regulatory agencies:

  • Federal Bureau of Investigation (FBI)
  • U.S. Department of Justice (DOJ)
  • Interpol

  • UK Intelligence and Policing
  • Europol
  • Hong Kong Police Force
  • Securities and Exchange Commission (SEC)
  • U.S. Department of Homeland Security (DHS)
  • U.S. Secret Service (USSS)
  • U.S. Attorney's Office

Defensible Cybersecurity Includes Knowing Your Third-party Cyber Risks

Protect your reputation and bottom line with Kroll’s third-party cyber risk management services. We can help you assess, identify and remediate with confidence. Speak with one of our experts today.

Connect with us

Connect with us

Keith Novak
Keith L Novak
Managing Director
Cyber Risk
New York

See all servicesStay Ahead with Kroll


Valuation of businesses, assets and alternative investments for financial reporting, tax and other purposes.

Compliance and Regulation

End-to-end governance, advisory and monitorship solutions to detect, mitigate and remediate security, legal, compliance and regulatory risk.

Corporate Finance and Restructuring

Middle Market M&A, Strategic Advisory, Debt Advisory and Private Capital Markets, Restructuring and Insolvency Services, Financial Due Diligence, Fairness Opinions, Solvency Opinions and ESOP/ERISA Advisory.

Cyber Risk

Incident response, digital forensics, breach notification, managed detection services, penetration testing, cyber assessments and advisory.

Environmental, Social and Governance

Advisory and technology solutions, including policies and procedures, screening and due diligence, disclosures and reporting and investigations, value creation, and monitoring.

Investigations and Disputes

World-wide expert services and tech-enabled advisory through all stages of diligence, forensic investigation, litigation, disputes and testimony.

Business Services

Expert provider of complex administrative solutions for capital events globally. Our services include claims and noticing administration, debt restructuring and liability management services, agency and trustee services and more.

Compliance Risk

Managing Reputational and Regulatory Risks During Sanctions Uncertainty

Mar 17, 2022

by Kevin BraineMariellen Davies-DeMarcoTom Everett HeathMichael Watt


ALM Intelligence Pacesetter Research – Cybersecurity Services 2020

Oct 28, 2020

by Jason N. SmolanoffMarc Brawner


Kroll Ransomware Attack Trends – 2020 YTD

Oct 06, 2020

by Devon AckermanKeith Wojcieszek Laurie Iacono


CVE-2020-1472 (Zerologon) Exploit Detection Cheat Sheet

Oct 22, 2020

by Carlos Garcia, Simone Marinari, Roman Guillermo

Press Release

Kroll Responder Recognized in 2023 Gartner Market Guide for Managed Detection and Response Services for the Third Consecutive Year

Mar 23, 2023


Kroll Launches Cyber Partner Program Delivering Lifetime Returns

Feb 28, 2023


Kroll Named an MDR “Champion” by Bloor Research

Feb 27, 2023

Press Release

Gartner Names Kroll a Representative Vendor for Managed Security Incident and Event Management

Jan 09, 2023


Kroll at RSA Conference 2023

Conference Conference Apr 24 - Apr 27, 2023 | Conference


KAPE Intensive Training and Certification

Online Event Online Event Apr 13 - Dec 07, 2023 | Online Event