PRA SS2/21 Third Party Risk Compliance Guide (2023) | UpGuard

This document summarizes the UK PRA Supervisory Statement SS2/21 on third‑party risk management and outsourcing, defining key terms (material outsourcing, outsourcing and non‑outsourcing third parties) and detailing requirements across data security, access/audit rights, sub‑outsourcing, business continuity, materiality assessments, due diligence, and contractual controls. It provides step‑by‑step guidance for complying with specific sections (e.g., 2.8, 2.9, 3.x, 5.x, 6.3, 7.x, 8.x), emphasizing proportionality, ongoing risk assessments, concentration risk, and regulatory alignment with EBA ICT GL, GDPR, and UK data protection law. Throughout, it highlights how UpGuard’s questionnaires, ratings, attack surface monitoring, trust pages, and remediation workflows can operationalize these requirements.