Last updated: 4 November 2026
Quick answer: Fourth-party risk management is the process of identifying and controlling risks from your vendors’ own suppliers and subcontractors. You usually cannot contract with fourth parties directly, so you manage them through your third parties: due diligence on their subcontracting practices, contract clauses, notification of changes, and monitoring of critical dependencies and concentration.
Your cloud provider runs on someone else’s data centres. Your payroll processor uses an external identity service. Your managed service provider relies on a remote monitoring tool. When any of those hidden links fails or is breached, the impact reaches you, even though you never signed a contract with them.
That is why fourth-party risk management has moved from a niche topic to a regulatory expectation. This guide explains what fourth-party risk is, what EU, UK and US rules expect, and a practical six-step method to bring your supply chain’s supply chain under control.
What is fourth-party risk management?
Fourth-party risk management extends third-party risk management one level deeper, to the subcontractors, sub-processors and service providers that your vendors rely on. The goal is not to audit every company in the chain, but to know which fourth parties support your critical services and to make sure your third parties manage them properly.
Typical fourth parties include:
- cloud infrastructure and hosting providers behind your SaaS vendors;
- sub-processors that handle personal data on behalf of your processors;
- software components, managed security tools and support desks used by your MSP;
- payment, identity, messaging and analytics services embedded in vendor products;
- offshore support centres and contractors employed by your outsourcers.
Common mistake: Treating fourth-party risk as a separate programme. It works best as an extension of your existing vendor and third-party risk management process, using the same criticality tiers, questionnaires and review cycles.
Why does fourth-party risk matter now?
Because regulators have made subcontracting chains explicit, and because concentration on a small number of technology providers means one fourth-party failure can hit many organisations at once. Several rules now require you to understand who sits behind your vendors.
EU: DORA, NIS2 and GDPR
For financial entities, Commission Delegated Regulation (EU) 2025/532, adopted on 24 March 2025 and in force since 22 July 2025, sets DORA’s rules on subcontracting ICT services that support critical or important functions. It requires due diligence before subcontracting is allowed, contract terms that keep the ICT provider responsible and give authorities access and inspection rights, advance notice of material changes with a reasonable period to approve or object, and termination rights if changes go ahead without approval. The DORA register of information also records the ICT service supply chain behind critical services.
Under the NIS2 Directive, Article 21(2)(d) requires supply chain security “concerning the relationships between each entity and its direct suppliers or service providers”. Article 21(3) adds that entities must consider the overall quality of products and cybersecurity practices of their suppliers, including secure development. Fourth parties are not named, but a direct supplier’s reliance on weak subcontractors is part of its cybersecurity practice.
Under the GDPR, Article 28 makes sub-processors a formal fourth-party regime: a processor needs the controller’s prior specific or general written authorisation to engage another processor, must pass on the same data protection obligations, and remains fully liable for the sub-processor’s performance.
UK: PRA and FCA expectations
The PRA’s SS2/21 on outsourcing and third-party risk management, in effect since 31 March 2022, has a dedicated chapter on sub-outsourcing. It notes that chain outsourcing can amplify risks in material outsourcing and limit a firm’s ability to manage them.
US: interagency guidance
The Interagency Guidance on Third-Party Relationships, issued by the Federal Reserve, FDIC and OCC in June 2023, asks banking organisations to evaluate a third party’s reliance on subcontractors during due diligence, negotiate subcontracting terms, and monitor compliance with subcontracting limits. The agencies made clear that the focus is on the third party’s processes for managing subcontractors, not direct oversight of every entity in the chain.
| Region | Main rule | Fourth-party expectation |
|---|---|---|
| EU | DORA RTS 2025/532; NIS2 Art. 21; GDPR Art. 28 | Subcontracting due diligence and contract terms; supplier practice quality; sub-processor authorisation |
| UK | PRA SS2/21; UK GDPR | Sub-outsourcing controls for material outsourcing; sub-processor authorisation |
| US | Interagency Guidance (2023); sector rules such as HIPAA business associate agreements | Assess, contract for and monitor third parties’ subcontractor management |
How do you manage fourth-party risk in six steps?
Start from your critical services and work outward. Six steps cover most programmes, whatever your sector.
- Tier your third parties. Focus on vendors that support critical or important functions, process sensitive personal data or hold privileged access. Fourth-party work for low-risk vendors rarely pays off.
- Ask for the subcontractor list. For each critical vendor, request the material subcontractors and sub-processors that support your service, what they do, where they operate and what data they handle.
- Assess the vendor’s subcontractor management. Add questions to your due diligence on how the vendor selects, contracts with and monitors its own suppliers, and whether it flows down security and data protection requirements.
- Put it in the contract. Include approval or notification rights for new or changed subcontractors, flow-down obligations, audit and information rights, incident notification that covers subcontractor incidents, and termination rights.
- Map concentration. Aggregate fourth parties across your vendor base to see where several critical vendors depend on the same cloud region, identity provider or software component.
- Monitor and refresh. Review subcontractor lists at each reassessment, track change notifications, and watch for public incidents affecting known fourth parties.
In practice: Many vendors already publish sub-processor lists for GDPR purposes. Use them as a starting point, then ask critical vendors to confirm which entries actually support your service and whether any non-data subcontractors, such as network or support providers, are missing.
Running these steps across dozens of vendors is much easier when questionnaires, contracts and risks live in one place. Enactia’s AI-powered GRC platform links vendor assessments to risks, controls and incidents, and maps the same questions across DORA, NIS2, ISO 27001 and GDPR. To try it on your own supplier base, start your 14-day free trial.
Which questions should you ask vendors about their subcontractors?
Keep the fourth-party section of your questionnaire short and specific. The following questions work well for critical vendors and can be scored in your compliance assessments.
| Area | Question | Good answer looks like |
|---|---|---|
| Inventory | Which subcontractors support the service you provide to us? | A current list with role, location and data access |
| Selection | How do you assess subcontractors before engaging them? | Documented due diligence with security and financial checks |
| Flow-down | Do your contracts pass on our security and data protection requirements? | Yes, with examples of standard clauses |
| Change | How and when will you notify us of new or changed subcontractors? | Advance written notice with a right to object |
| Incidents | Will you notify us of incidents at your subcontractors that affect our service? | Yes, within timeframes that support our own reporting duties |
| Assurance | What evidence do you hold on critical subcontractors? | Certifications, audit reports or assessments reviewed at least yearly |
| Exit | What happens if a critical subcontractor fails? | Tested continuity plans or alternative providers |
How do you measure and report fourth-party risk?
Report fourth-party risk as part of your third-party risk dashboard, not as a separate report. Management needs to see where hidden dependencies could affect critical services.
Useful indicators include the share of critical vendors that have provided a subcontractor list, the number of critical services that depend on the same fourth party, open contract gaps on subcontracting clauses, and change notifications received and reviewed. Record the most significant concentrations as risks in your enterprise risk register with an owner and treatment plan. For board-level context, see our article on why vendor risk is now an executive liability.
Key takeaways
- Fourth-party risk management covers your vendors’ subcontractors, sub-processors and embedded service providers.
- You manage fourth parties through your third parties, using due diligence, contracts and monitoring.
- DORA’s subcontracting RTS (EU) 2025/532, GDPR Article 28, PRA SS2/21 and US interagency guidance all address subcontracting chains.
- Focus on critical vendors and map concentration across your supplier base.
- Build fourth-party questions into your existing vendor risk process rather than a separate programme.
Frequently asked questions
What is the difference between third-party and fourth-party risk?
Third-party risk comes from organisations you contract with directly, such as software vendors, cloud providers and outsourcers. Fourth-party risk comes from the suppliers those vendors rely on. You have a contract with the third party but usually not with the fourth party, so you manage fourth-party risk indirectly through your third party’s contracts and controls.
Do regulations require fourth-party risk management?
Several do in substance. DORA’s RTS 2025/532 sets conditions for subcontracting ICT services that support critical or important functions, GDPR Article 28 regulates sub-processors, PRA SS2/21 covers sub-outsourcing, and US interagency guidance asks banks to evaluate third parties’ subcontractor oversight. NIS2 focuses on direct suppliers but considers their overall security practices.
Should we assess every fourth party directly?
No. That is rarely practical or expected. Focus on vendors that support critical services, ask them for their material subcontractors, and assess how the vendor manages those subcontractors. Direct review of a fourth party is usually reserved for exceptional cases, such as a single provider that underpins several of your critical services.
What is concentration risk in fourth-party management?
Concentration risk arises when many of your vendors depend on the same underlying provider, such as a single cloud region or identity service. One failure at that fourth party could then disrupt several critical services at once. Mapping fourth parties across your whole vendor base is the only way to see these shared dependencies.
How often should fourth-party information be reviewed?
Review subcontractor information at each periodic vendor reassessment, typically yearly for critical vendors, and whenever a vendor notifies a material change. Also review it after significant public incidents that affect a known fourth party, so you can confirm quickly whether your services are exposed and whether reporting duties apply.
See further down your supply chain
Fourth-party risk management is about visibility and leverage: knowing which hidden providers support your critical services and using contracts and due diligence to make sure your vendors manage them well. Start with your most critical vendors, ask for their subcontractor lists, close contract gaps and map concentration. Each step also strengthens your evidence for DORA, NIS2 and GDPR.
To discuss your third-party and fourth-party risk programme, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
