How to Write Third-Party Risk Management (TPRM) Policies and Procedures

**Executive summary:** This document outlines how organizations should build and operationalize third-party risk management (TPRM) programs by distinguishing vendors from third-parties, assessing operational, reputational, and compliance risks, and implementing practices to identify/analyze third-party access, define controls, set measurable metrics, and continuously monitor partners; it highlights SecurityScorecard’s security ratings and Atlas platform as tools to enable real-time verification and a “verify then trust” approach.