How an IT Provider Helps You Manage Vendor and Third-Party Risk
Updated: Sep 28
Updated September 27, 2026 · By Shannon Jones, Roo Tech Services
The short answer: Third-party risk is the chance that a vendor, software company or outside service you rely on gets hacked or fails, and takes your business down with it. A good IT provider helps by keeping an inventory of who can access your systems, limiting that access, watching for problems, and making sure you can keep working if a vendor goes down.
What is third-party risk?
Every small business depends on outside companies: your accounting software, payroll service, line-of-business application, email provider, website host, credit card processor, and often an IT provider too. Each of those companies has some level of access to your data or your systems.
If one of them has a security failure, you can be affected even if your own security is excellent. That's third-party risk, sometimes called vendor risk or supply chain risk.
Is this a real problem for small businesses?
Yes. Some of the most damaging attacks of the last few years started with a vendor:
In July 2021, attackers used a flaw in Kaseya's remote management software to spread ransomware through IT providers to as many as 1,500 downstream businesses.
In June 2024, a ransomware attack on CDK Global, a software company that serves car dealerships, disrupted operations at thousands of dealerships across the country for weeks.
In February 2024, an attack on Change Healthcare disrupted claims processing and payments for doctors' offices and pharmacies nationwide.
Most of the businesses affected did nothing wrong. They simply depended on a vendor that was hit.
Where does third-party risk hide in a typical small business?
Remote access tools that vendors use to support your software
Shared passwords given to vendors years ago and never changed
Cloud apps connected to your Microsoft 365 or Google account
Old integrations nobody remembers setting up
Your IT provider itself, which usually has administrator access to everything
How does an IT provider help manage it?
1. Know who has access. We keep an inventory of the vendors and apps connected to your systems, and what each one can reach.
2. Limit access. Vendors get their own accounts, only the access they need, and multi-factor authentication. Remote access can be turned on only when a vendor needs it, instead of being left open all the time.
3. Remove what's no longer needed. Old vendor accounts, stale integrations and apps nobody uses get shut off.
4. Watch for problems. Monitoring on your network, computers and Microsoft 365 account flags unusual logins and activity, including activity coming from a vendor's connection.
5. Plan for a vendor outage. Backups you control, and a plan for working around a critical vendor being down, keep your business moving when someone else has a bad day.
6. Ask vendors the right questions. Before you sign up for new software, we can help you ask how the vendor protects your data, whether they use multi-factor authentication, and what happens to your data if you leave.
What about the risk from your IT provider?
It's a fair question, and you should ask it. Your IT provider holds the keys to your systems, so they should protect their own access carefully. Ask any provider, including us, whether they use multi-factor authentication on every tool, how they secure their remote management software, and whether you own your passwords and documentation.
Frequently asked questions
What is third-party risk management?
It's the process of identifying the outside companies your business depends on, understanding what access they have, reducing that access to what's necessary, and planning for what happens if one of them is breached or goes offline.
Do small businesses need vendor risk management?
Yes, in a right-sized form. You don't need a compliance department. You need a list of vendors with access, strong logins for each, access removed when it's no longer needed, and backups you control.
Can my IT provider be a third-party risk?
Yes. An IT provider usually has administrator access to your systems. A good provider protects that access with multi-factor authentication, limits who on their team can use it, and is open with you about how they secure their tools.
Need help taking stock?
Roo Tech Services helps small businesses in Knoxville and East Tennessee get control of who can access their systems. Learn about our managed IT services, book a free consultation, or call 865-332-0008.
About the author: Shannon Jones is the founder of Roo Tech Services, a veteran-owned IT company in Knoxville, Tennessee. He served in the U.S. Marine Corps from 2000 to 2004, including in Iraq in 2003, and is Fortinet NSE 3 certified.
Comments