Vendorapp › OpenVMO › Fourth parties and supply chain
Fourth parties and supply chain in OpenVMO.
Fourth parties are your vendors’ vendors: the cloud, payment, email and AI providers behind the tools you use. You cannot assess them all, but for your most important vendors you should know who they are and hear when they change.
Open standard, CC BY 4.0 · Free, no sign-up · Works with a spreadsheet · Maps to SOC 2, ISO 27001, NIS2, DORA
Why it matters
What this domain is for.
Many recent supply-chain incidents started one step removed, at a provider many vendors shared. Regulators now expect you to know the chain for critical services, and customers increasingly ask for your subprocessors’ subprocessors.
Fourth parties and supply chain is one of the 11 domains of the OpenVMO framework, an open standard for running vendor management at a startup. Each practice below has a minimum maturity level: you only need the practices at or below the level you are aiming for.
Practices
The 4 FP practices.
Subprocessor lists for Tier 1
For every Tier 1 vendor, the subprocessor or fourth-party list is obtained and stored, from a public list, the DPA annex or on request. Evidence: The stored list for each Tier 1 vendor, with its source and date.
Change notices reviewed
Subprocessor change notifications are received and reviewed. Evidence: The notification subscription, and review records for recent changes.
Shared dependencies identified
Material shared dependencies, such as a single cloud region or identity provider behind several critical vendors, are identified. Evidence: The concentration analysis showing shared fourth parties.
Chain recorded for critical functions
Where regulation requires it, the full subcontracting chain is recorded for vendors supporting critical functions. Evidence: The recorded chain for each critical-function vendor.
A practice counts as in place only when a dated record shows it was performed. A tool that could perform it does not count on its own.
By stage
What good looks like at each level.
| Level | What good looks like |
|---|---|
| Level 1: Foundational | Not yet required. Knowing your direct vendors comes first. |
| Level 2: Managed | Subprocessor lists stored for Tier 1 vendors, and change notices read. |
| Level 3: Defined | Shared fourth parties identified across critical services. |
| Level 4: Optimised | Full subcontracting chains recorded for critical functions, in regulator formats where required. |
With a spreadsheet
Doing it without any special tool.
- Add a "subprocessor list URL" column for Tier 1 vendors and save a dated copy of each list.
- Subscribe to each Tier 1 vendor’s subprocessor change notifications with a shared mailbox.
- Keep a second tab listing fourth parties and which of your vendors use each one.
Common mistakes
Where teams usually go wrong.
- Trying to assess every fourth party directly. Rely on your vendor’s own oversight and contract terms.
- Ignoring subprocessor change emails, which often carry a deadline to object.
- Not noticing that most of your critical vendors depend on the same cloud region.
Crosswalk
How this maps to the frameworks you are audited against.
| Framework | Related requirements |
|---|---|
| SOC 2 (Trust Services Criteria) | CC9.2 (subservice organisations) |
| ISO/IEC 27001:2022 | A.5.21 |
| NIS2 and Implementing Regulation 2024/2690 | Art. 21(3) |
| DORA | Art. 29; Art. 30(2)(a); RTS on subcontracting |
| NIST CSF 2.0 | GV.SC-07 |
The mapping is informative, not legal advice: it points to where each framework deals with the same topic. The full mapping for every practice is on the crosswalk page.
Templates
Templates for this domain.
- Vendor register (CSV): The register with every OpenVMO minimum field as a column, plus two example rows. Open it in any spreadsheet.
All OpenVMO templates are on the templates page.
Previous domain: Ongoing monitoring. Next domain: Third-party incidents.
Run OpenVMO with a spreadsheet, or with a tool.
Every practice can be met with the free templates. If you would rather not maintain the register by hand, Vendorapp implements most of OpenVMO and has a free plan.