A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →Third-Party Risk Management (TPRM) is the ongoing programme for identifying, assessing, and monitoring the security and privacy risk that vendors, suppliers, and partners introduce. It covers the full life cycle: due diligence before onboarding, contractual safeguards, risk tiering, and periodic review while the relationship lasts. It is how an organization answers for risk it does not directly control.
The backbone of a working programme is a single vendor inventory with a risk tier against each entry. Without it, you cannot show an auditor that assessments happened in line with your own policy, which is the actual test.
The depth of each assessment should follow the tier, not the invoice. A cheap logging tool that receives request payloads deserves more scrutiny than an expensive platform that never sees customer data.
traztech delivers third-party risk management for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
TPRM becomes real at audit, where SOC 2 (CC9.2) and ISO 27001:2022 (A.5.19 to A.5.22) both ask how you manage suppliers, and findings here are common because the work is unglamorous. It also arrives through your own customers, whose vendor-risk teams are doing exactly this to you. We run it as third-party risk management.
The mistake is treating every vendor the same. A risk-tiered inventory lets a vendor that can reach production data earn a real assessment while one that cannot earns a record and a signature. It connects directly to your subprocessor obligations under privacy law.
Subprocessor management is a subset. TPRM covers every third party that introduces risk, including those that never touch customer personal data, whereas subprocessor obligations are specifically about vendors processing that data on your behalf.
Let the tier decide. High-risk vendors that can reach sensitive data warrant at least annual review and a look at their current SOC 2 or ISO certificate; low-risk ones can be lighter and less frequent.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
Track record
Five published CVEs. CVE-2024-45163 (CVSS 9.1) is a flaw in the Mirai botnet itself, which gave defenders a way to shut down attacker infrastructure. CVE-2026-42626 takes HP ENVY 5000 printers offline from any unauthenticated device on the same network.
At Humera, a venture-backed US security company, Jacob built the compliance programme in-house from nothing: no report, no policies, no documented controls. It ended in a Type II attestation with zero exceptions.