Third-party risk is not limited to software, cloud, and technology suppliers. Law firms can hold privileged investigation files. Marketing agencies can process customer lists and credentials. Call centers can access production systems and payment data. Facilities providers can enter secure locations, maintain critical equipment, and employ large subcontractor networks.
A strong TPRM program assesses the activity and exposure created by the relationship, not whether the supplier is labelled “IT.” This guide explains how to tier and review non-IT third parties using practical evidence for data, people, physical access, financial, compliance, operational, and subcontractor risk.
What Is Non-IT Third-Party Risk?
Non-IT third-party risk is the risk created by external organizations that primarily deliver professional, operational, physical, creative, logistics, staffing, legal, or customer-support services. Many still use technology and process data, but the service is not purchased as an IT product.
Examples include:
- Law firms, investigators, auditors, consultants, and tax advisers.
- Marketing, advertising, public-relations, and event agencies.
- Call centers, business-process outsourcers, and collection agencies.
- Facilities management, security guards, maintenance, cleaning, and catering.
- Recruiters, staffing firms, background-screening providers, and training partners.
- Logistics, warehousing, couriers, document destruction, and records storage.
- Benefits administrators, payroll support, travel agencies, and relocation providers.
The 2023 U.S. interagency guidance on third-party relationships emphasizes that due diligence should be tailored to the specific activity and proportionate to risk and complexity. This is the right foundation for non-IT reviews: do not send every vendor the same cybersecurity questionnaire, and do not exempt a vendor merely because it does not sell software.
Start With Exposure, Not Category
Use intake questions that identify what the supplier can affect:
- What business process, customer commitment, or regulated activity does it support?
- What personal, confidential, privileged, financial, health, payment, or employee data will it receive?
- Will its personnel access systems, premises, records, equipment, or customers?
- Can it act, communicate, collect money, or make representations on the organization’s behalf?
- Could service failure stop operations, create safety risk, breach law, or damage customers?
- Which subcontractors, temporary workers, locations, and offshore teams are involved?
- What fraud, bribery, sanctions, conflicts, licensing, or professional-conduct risks apply?
- How will access, records, property, and data be returned or destroyed at exit?
Tiering should follow the highest material exposure. A small agency with administrator access to a social account can be high risk. A large office-supplies supplier with no sensitive data or critical dependency may be low risk.
Risk Domains For Non-IT Vendors
Data and confidentiality
Identify data elements, subjects, purpose, transfer method, storage locations, retention, deletion, and onward sharing. Include paper records, photographs, recordings, portable media, case files, and collaboration platforms. Confidentiality risk exists outside formal databases.
People and insider risk
Review screening appropriate to role and law, confidentiality obligations, training, supervision, joiner-mover-leaver controls, disciplinary processes, temporary staff, and subcontractor personnel. Confirm that access is tied to named individuals where practical.
Physical and site access
For on-site providers, review badges, visitor controls, restricted areas, key management, escort rules, equipment rooms, clean-desk expectations, photography, incident reporting, and access removal. NIST SP 800-171 Rev. 3 provides useful control outcomes for physical-access authorization, credential issuance, access-list review, and removal.
Operational resilience
Assess staffing capacity, geographic concentration, labor disruption, alternate sites, manual workarounds, emergency contacts, recovery objectives, and testing. A call center or facilities provider may be more operationally critical than many technology vendors.
Conduct and compliance
Map licensing, professional standards, consumer protection, recording consent, collections practices, health and safety, anti-bribery, sanctions, accessibility, labor, and sector-specific duties to the activity. Ask for evidence that reflects the relevant obligation.
Financial and fraud risk
Consider financial capacity, insurance, billing controls, client-money handling, purchase authority, refunds, expense access, conflicts of interest, gifts, commissions, and changes in ownership or key personnel.
Reputation and representation
Vendors that speak to customers, publish content, handle complaints, collect debt, or represent the brand require scripts, approvals, monitoring, escalation, and clear limits of authority.
Subcontractor and location risk
Identify who actually performs the work. Require approval or notification for material subcontractors, flow down relevant requirements, and maintain visibility into locations, access, data, and incident responsibilities.
Evidence By Vendor Type
Law firms and investigators
- Engagement scope, conflicts process, professional licensing, and insurance.
- Confidentiality, legal privilege handling, matter access, and ethical walls.
- Secure file exchange, remote access, retention, legal hold, and destruction.
- Use of e-discovery, translators, experts, local counsel, and other subprocessors.
- Incident notification and return of complete matter files.
Facilities and physical-service providers
- Personnel screening, training, uniforms, badges, keys, and supervision.
- Site list, restricted areas, after-hours access, and visitor controls.
- Safety certifications, maintenance competence, insurance, and incident records.
- Emergency coverage, spare parts, alternate personnel, and escalation.
- Subcontractors, waste handling, records destruction, and access termination.
Marketing and creative agencies
- Customer-list purpose, consent, suppression lists, data sources, and sharing.
- Administrator access to websites, domains, analytics, advertising, and social accounts.
- Campaign approval, brand controls, accessibility, claims substantiation, and content rights.
- Use of freelancers, AI tools, stock media, tracking technologies, and data brokers.
- Credential return, asset ownership, audience deletion, and campaign archives.
Call centers and business-process outsourcers
- Agent screening, training, monitoring, scripts, and quality assurance.
- System roles, desktop restrictions, recording, copy controls, and authentication.
- Payment handling, sensitive-data masking, clean-room controls, and personal devices.
- Fraud escalation, complaints, vulnerable customers, and regulatory scripts.
- Staffing resilience, site concentration, telecom dependency, and recovery tests.
A Practical Review Workflow
1. Describe the activity
Write one plain-language statement covering service, users, locations, data, access, authority, dependencies, and failure impact. Do not start with a generic vendor category.
2. Trigger relevant domains
Use exposure answers to route privacy, security, physical security, resilience, legal, compliance, finance, sanctions, safety, or other reviews. Avoid making every specialist review every relationship.
3. Request activity-specific evidence
Evidence should demonstrate the control outcome. A facilities supplier may need access rosters and safety records; a law firm may need matter-access controls; a call center may need agent-screening and recording evidence.
4. Validate operation
For high-risk services, supplement policies with samples, system demonstrations, site visits, call monitoring, training records, access exports, test results, incident records, or independent assurance.
5. Contract the actual controls
Translate material requirements into obligations: approved personnel, site restrictions, confidentiality, audit rights, incident timelines, subcontractor controls, continuity, insurance, data return, deletion, and transition support.
6. Monitor service and risk
Combine business-performance indicators with risk indicators. Complaints, staff turnover, missed maintenance, access anomalies, subcontractor changes, adverse media, financial deterioration, and safety incidents may be more useful than a cyber score.
7. Offboard people, property, and information
Remove physical and logical access, retrieve badges and keys, return documents and equipment, transfer work product, revoke authority, complete data deletion, and capture evidence.
Common Mistakes
Sending a cybersecurity questionnaire to every supplier
Cyber controls matter when technology or data exposure exists, but the review should also cover the actual operational, people, physical, conduct, and resilience risks.
Assuming professional status proves controls
Licensing and reputation do not replace review of matter access, subcontractors, incident handling, continuity, and data practices.
Ignoring temporary and subcontracted workers
The individual performing the work may be several contractual layers away. Requirements must reach the actual personnel and locations.
Separating physical and digital access
A facilities worker may reach network rooms; a call-center agent may access production systems; a marketing agency may administer domains. Review combined exposure.
Monitoring Indicators By Service Type
Ongoing monitoring should reflect how the service can fail. For law firms, track matter-team changes, unusual download activity, missed legal deadlines, conflicts, insurer changes, and new e-discovery providers. For facilities suppliers, monitor badge exceptions, safety events, missed preventive maintenance, emergency-response times, staff turnover, and subcontractor changes. For marketing agencies, watch administrator-role changes, campaign complaints, unapproved claims, tracking changes, audience exports, and new freelance or AI-tool use. For call centers, review authentication failures, quality scores, complaint patterns, recording exceptions, payment-data exposure, absenteeism, unusual access, and site outages.
Set thresholds that trigger action. A high staff-turnover rate may require access sampling and training evidence. A new offshore subcontractor may trigger privacy, sanctions, resilience, and contract review. Repeated service failures may change criticality or require an alternate provider. Document the signal, owner, decision, and follow-up instead of collecting dashboards that do not change risk treatment.
Contract Controls For Non-IT Services
Contracts should address the exposure identified during review. Relevant clauses may cover approved personnel and locations, screening, training, confidentiality, physical access, records handling, data restrictions, subcontractor approval, insurance, licensing, incident notification, regulatory cooperation, service levels, business continuity, audit rights, complaint handling, use of the organization’s name, return of property, data deletion, and transition support. Avoid copying a technology schedule into a contract when it misses the real operational risk.
Analyst Takeaway
Non-IT does not mean low risk. Build the review from the activity: what the provider can see, enter, change, represent, interrupt, or transfer. Route only relevant domains, request evidence that proves the real control, and monitor signals tied to the service. This makes TPRM both more proportionate and more complete.
FAQ
Do all non-IT vendors require a full assessment?
No. Use intake and tiering to identify material exposure. Low-risk vendors can follow a simplified route; high-risk relationships need focused review.
Can a law firm be a critical vendor?
Yes, if it supports a critical investigation, transaction, regulatory matter, or service with no timely substitute. Criticality depends on impact and substitutability, not sector.
Who should review facilities vendors?
Facilities, physical security, safety, procurement, TPRM, and information security may all contribute depending on site and system access. Assign one accountable owner.
What is the best monitoring approach?
Use service-specific signals such as complaints, access, staff turnover, incidents, continuity tests, financial health, subcontractor changes, and overdue actions.
