Third Party Risk Management for Security

Which Australian requirements cover third party security risk?

Commonwealth entities. PSPF Release 2026 has a dedicated Third Party Risk Management section.¹ In summary, the entity remains accountable for security risks arising from procurement; service providers, contractors and subcontractors must comply with the PSPF requirements the entity specifies; contract terms must require providers to report actual or suspected security incidents; contract security terms must be monitored and reviewed over the life of the contract; risks from foreign ownership, control or influence must be considered before engaging a provider and during the contract; and contract security risks must be reassessed and adjusted over time. Because these requirements flow down through contracts, suppliers to government are affected too.

Critical infrastructure. Responsible entities covered by the SOCI Act must address supply chain hazards in their critical infrastructure risk management program under section 10 of the CIRMP Rules, with enhanced requirements in section 10A for the asset classes covered by the Enhanced CIRMP Rules.² See the CIRMP physical security playbook and the CIRMP personnel security playbook for the related hazard vectors.

APRA-regulated entities. CPS 230 requires banks, insurers and superannuation trustees to manage the risks of material service providers and to keep critical operations running through disruption.³ See the CPS 230 business continuity guide.

Defence suppliers. Businesses that work on Defence contracts may need Defence Industry Security Program membership, which covers governance, personnel, physical and information and cyber security.⁴ See DISP consulting.

The third party risk management lifecycle

1. Identify and tier. List every supplier with access to your people, sites, information or critical operations. Tier them by what happens if they fail or are compromised. Most organisations find a small number of critical suppliers carry most of the risk.
2. Assess before engaging. For critical suppliers, check ownership and control, the personnel who will have access, how they protect your information, their own reliance on subcontractors, and their ability to keep supplying through disruption.
3. Contract for security. Put the requirements in the contract: the controls to be met, incident reporting, approval of subcontractors, rights to audit or inspect, and what happens at the end of the contract.
4. Monitor over the contract. Track a few indicators for each critical supplier and reassess when something changes. The key risk indicators guide explains how to set them.
5. Exit cleanly. Cancel access cards and accounts, recover keys and equipment, and confirm the return or destruction of information. Exit is where many access gaps are left open.

Where does supplier risk intelligence come from?

Supplier risk intelligence is the information that tells you whether a supplier is who it says it is, and whether anything about it should change your assessment. Much of it is free and public. Useful sources in Australia include:

• Identity and status: ABN Lookup for the business’s ABN, entity type and GST registration, and ASIC’s registers for company details.
• Sanctions: the Department of Foreign Affairs and Trade’s Consolidated List of persons and entities subject to Australian sanctions.
• Ownership and control: the supplier’s own declarations about foreign ownership, control or influence, checked against what public records show.
• Performance and incidents: your own records of late deliveries, security incidents and audit findings, which are often the earliest warning.
• News and legal actions: media reports, regulator announcements and court decisions involving the supplier or its directors.

Check critical suppliers before engaging them, and again at renewal or after a material change. Commercial risk intelligence services can automate the monitoring, but they work best on top of a clear view of which suppliers are critical.

Common gaps in third party security

• Contractor access cards and accounts that stay active after the work ends.
• Subcontractors on site that the organisation did not know about.
• Security questionnaires completed at onboarding and never checked or repeated.
• Contracts with no incident reporting duty and no right to inspect.
• Critical suppliers with no tested plan for continuing supply during a disruption.
• Treating third party risk as an IT matter, so physical and personnel access is never assessed.

How Agilient helps

Agilient assesses third party security risk as part of security risk assessments and security audits: tiering suppliers, reviewing contract security terms, assessing contractor access to sites and information, and checking that suppliers can keep critical services running. Agilient works on governance and assurance; it does not perform technical cyber testing and does not sell security products. See also the supply chain security framework guide.