What Is Fourth-Party Risk?

Fourth-party risk is the risk an organization carries through its suppliers’ own suppliers, meaning the subcontractors, cloud providers and other service providers that a third party relies on to deliver its service, with whom the organization usually has no contract of its own. Nth-party risk extends the same idea further down the chain, to the suppliers of those subcontractors. The organization still carries the consequences when any of them fails, but it has less direct control at each step.

Fourth-party risk sits inside third-party risk management (TPRM), which the Federal Reserve, the FDIC and the OCC describe in their Interagency Guidance on Third-Party Relationships of June 2023 as the work to “identify, assess, monitor, and control risks related to third-party relationships.” None of the regulatory texts cited here uses the words fourth party. US banking guidance calls these organizations subcontractors, DORA places them in a ranked ICT service supply chain, and the EBA notes that subcontracting is also referred to as a “chain of subcontracting” or the use of “nth party service providers.”

What is the difference between third-party, fourth-party and nth-party risk?

The difference is the distance between you and the organization that fails.

• A third party is any organization you have a business arrangement with, such as a supplier, a service provider or a partner. The interagency guidance covers any business arrangement “by contract or otherwise”.
• A fourth party is an organization your third party relies on to serve you, such as its cloud host, its payment processor or its customer support contractor.
• An nth party is any organization further down that chain, such as the data center operator behind your supplier’s cloud host.

At each step down the chain, your direct control falls. The interagency guidance says subcontracting “can result in risk due to the absence of a direct relationship between the banking organization and the subcontractor, further lessening the banking organization’s direct control of activities.”

Why does fourth-party risk matter?

Fourth-party risk matters for 3 reasons, and the third is the hardest to see.

• You inherit a subcontractor’s weaknesses without a contract that lets you require a fix, so any remedy has to run through your supplier.
• A subcontractor in another country can bring legal and data risks your own supplier does not, and both DORA (Article 29(2)) and the interagency guidance name the location of subcontractors as a risk to weigh.
• Several of your suppliers may rely on the same provider, so one failure can stop several services at once, even though no single contract shows the dependency.

The third reason is concentration risk. DORA defines ICT concentration risk as an exposure to individual or multiple related critical ICT third-party service providers that creates “a degree of dependency on such providers” so that their unavailability or failure may endanger the ability of a financial entity to deliver critical or important functions (Article 3(29)). A dependency hidden one level down is still a dependency.

What do regulators expect for fourth parties and subcontractors?

US and EU sources agree on the principle and differ on the detail. None of the texts below asks an organization to oversee every subcontractor directly. Each expects it to know which subcontractors matter and how its suppliers oversee them.

The US agencies made the limit explicit when they finalized their guidance. Answering concerns that banks might be expected to assess or oversee all subcontractors of a third party, they revised the text to focus on “a banking organization’s approach to evaluating its third party’s own processes for overseeing subcontractors and managing risks.”

How do organizations detect fourth-party risk?

Organizations detect fourth parties by combining what suppliers disclose with what can be observed, and then mapping the result across the whole supplier portfolio.

1. Ask each supplier, in due diligence and at each reassessment, which subcontractors support your service, where they operate and what data they handle.
2. Require notice in the contract. The interagency guidance suggests addressing when and how a third party should notify you of its use or intent to use a subcontractor, and DORA requires advance notice of a change in where services are provided or data is processed (Article 30(2)(b)).
3. Read each supplier’s independent assurance reports for the service providers they name.
4. Observe from outside. A supplier’s public technical records, such as its domain, mail and hosting records, often show which cloud, email and content delivery providers it uses.
5. Map every supplier’s providers in one place, so a provider shared by several suppliers becomes visible.

The last step matters most. A fourth party that appears once in a supplier file looks harmless, while the same provider behind many of your critical services is a concentration risk.

How do organizations monitor subcontractor risk?

Monitor subcontractors mainly through the supplier that engaged them, and directly only where the risk warrants it. The interagency guidance lists “the third party’s reliance on, exposure to, and use of subcontractors, the location of subcontractors (and any related data), and the third party’s own risk management processes for monitoring subcontractors” among the factors of ongoing monitoring.

• Check the supplier’s own subcontractor oversight as part of each assessment, including how it selects subcontractors and how it checks their controls.
• For subcontractors that support a critical service, write flow-down clauses, notice periods and rights of access and audit into the contract, as the EBA’s 2019 guidelines and NIST SP 800-161 Rev. 1 describe.
• Treat a new or changed subcontractor as an event that reopens the assessment, instead of waiting for the next annual review.
• Watch the outside-in signals of important subcontractors in the same way you watch those of your direct suppliers.

How to keep a critical supplier’s controls under check between reviews, including the events that should reopen an assessment, is set out in How to Continuously Validate Third-Party Controls.

How do organizations manage concentration risk?

Concentration risk is managed by finding where critical services depend on the same provider, deciding whether that dependency is acceptable, and preparing for its failure. DORA asks financial entities, before they contract for ICT services that support critical or important functions, to consider whether the provider is not easily substitutable and whether they would hold several arrangements with the same or closely connected providers (Article 29(1)). The interagency guidance names “dependency on a single provider for multiple activities” as a risk to consider.

1. Map each critical service to its direct suppliers and to the providers behind them.
2. Group the map by provider, so every critical service that depends on one provider shows up together.
3. Assess how easily each concentrated provider could be replaced, and what would stop if it failed.
4. Decide whether to accept, reduce or spread the concentration, and record who decided.
5. Write and test exit and continuity plans for the concentrations you accept, which DORA requires for ICT services that support critical or important functions (Article 28(8)).
6. Review the map whenever a supplier reports a change of subcontractor or location.

Concentration risk is also an operational resilience question, because the test is whether critical operations continue through the failure of a shared provider. That is why the map belongs in business continuity planning as well as in the supplier files.

An illustration: one provider behind several suppliers

This example is an illustration. The bank and its suppliers are invented, and the example uses no figures.

A bank has separate contracts with separate companies for its online banking platform, its customer support chat and its document signing service. None of the contracts mentions a shared dependency. When the bank maps its suppliers’ providers, it finds that all of these services run on the same cloud provider, in the same region.

Each supplier passed its own assessment, and none of them did anything wrong. The risk sits in the combination. The bank records the concentration, asks each supplier how it would fail over to another region, adds the scenario to its business continuity testing and puts the dependency in its risk register next to the services it affects. If those services support critical or important functions, a financial entity under DORA also records the provider in its register of information, ranked behind each supplier.

How DigitalXForce handles fourth-party risk

External Risk View is the outside-in engine of the DigitalXForce platform. It monitors exposed services, misconfigurations, vulnerability exposure, dark web and breach intelligence, lookalike domains and cyber ratings, and it maps fourth-party and nth-party dependencies, as the FAQ answer on External Risk View states. The AI-Powered Third-Party Risk Management (TPRM) module adds the supplier’s own disclosures through category questionnaires and review and reassessment workflows.

For financial entities, DigitalXForce produces DORA’s register of information in the templates of the European Supervisory Authorities. For resilience, Business Continuity and Operational Resilience (X-BCOR) ties business impact analysis, continuity plans and disaster recovery plans to live control coverage, and it supports scenario planning and control dependency mapping for critical processes. How the supplier lifecycle runs on the platform is documented in How does DigitalXForce third-party risk management work?

Where DigitalXForce is not the answer

A startup or small company preparing its first SOC 2 report, with a short list of suppliers, does not need fourth-party mapping at this depth, and DigitalXForce Lite serves that case, since it runs the same platform in the cloud with the same functionality and a faster deployment. No outside-in tool can see a subcontractor that leaves no public trace, such as a support team working inside a supplier’s own systems, so the questionnaire and the contract remain the only way to learn about it.

Questions about fourth-party risk

What is fourth-party risk?

Fourth-party risk is the risk an organization carries through its suppliers’ own suppliers, such as the cloud providers and subcontractors a third party relies on to deliver its service. The organization usually has no contract with these companies, so it has less direct control over them, yet it still carries the consequences when they fail.

What is the difference between third-party and fourth-party risk?

A third party is an organization you have a business arrangement with. A fourth party is an organization your third party relies on to serve you, with whom you usually have no contract, so any remedy has to run through your supplier.

What is nth-party risk?

Nth-party risk is the risk from organizations further down the supply chain than fourth parties, such as the data center operator behind a supplier’s cloud host. The EBA notes that subcontracting is also referred to as the use of nth party service providers.

How do organizations detect fourth-party risk?

They ask suppliers which subcontractors support the service, require notice of changes in the contract, read suppliers’ assurance reports, observe suppliers’ public technical records and map every supplier’s providers in one place. The last step is what shows a provider shared by several suppliers.

How do organizations monitor subcontractor risk?

They monitor it mainly through the supplier that engaged them. US banking guidance focuses on how the third party selects and oversees its own subcontractors, and it expects ongoing monitoring of the third party’s reliance on subcontractors and their locations. Critical subcontractors also warrant contract clauses on notice, flow-down requirements and rights of access and audit.

How do organizations manage third-party concentration risk?

They map critical services to their suppliers and to the providers behind them, group the map by provider, assess how easily each concentrated provider could be replaced and decide whether to accept or reduce the dependency. Accepted concentrations get tested exit and continuity plans, which DORA requires for ICT services that support critical or important functions.

Does DORA require financial entities to track fourth parties?

DORA does not use the term fourth party, but it covers the same ground. Financial entities must weigh the risks of subcontracting for critical or important functions, and under Implementing Regulation (EU) 2024/2956 they record in the register of information the subcontractors that effectively underpin those services, each with a rank in the ICT service supply chain.

Sources

• The Federal Reserve, the FDIC and the OCC issued the Interagency Guidance on Third-Party Relationships: Risk Management on 6 June 2023, published at 88 FR 37920 on 9 June 2023, at https://www.federalregister.gov/documents/2023/06/09/2023-12340/interagency-guidance-on-third-party-relationships-risk-management. Reliance on subcontractors is in section C.2.l, subcontracting clauses in section C.3.n, ongoing monitoring in section C.4, and the agencies’ response on subcontractors is in the preamble, section F.
• Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA), of 14 December 2022, applies from 17 January 2025. Article 3(29) and Articles 28 to 30 were read from the Publications Office text at https://publications.europa.eu/resource/celex/32022R2554.
• Commission Implementing Regulation (EU) 2024/2956 of 29 November 2024 lays down the standard templates for the register of information, and Articles 1 and 2 define the ICT service supply chain and the rank, at https://publications.europa.eu/resource/celex/32024R2956.
• The EBA published its Guidelines on outsourcing arrangements, EBA/GL/2019/02, on 25 February 2019, at https://www.eba.europa.eu/sites/default/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3-702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf, with sub-outsourcing in section 13.1.
• The EBA published its final Guidelines on the sound management of third-party risk related to non-ICT services, EBA/GL/2026/09, on 18 September 2026, at https://www.eba.europa.eu/activities/single-rulebook/regulatory-activities/internal-governance/guidelines-third-party-risk-management. Once they apply, they repeal EBA/GL/2019/02, and their definition of subcontracting carries the footnote on nth party service providers.
• NIST published The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29, on 26 February 2024, at https://doi.org/10.6028/NIST.CSWP.29.
• NIST published SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations, in May 2022, with updates as of 1 November 2024, at https://csrc.nist.gov/pubs/sp/800/161/r1/upd1/final, and its control guidance asks for requirements to flow down to relevant sub-tier contractors.
• Every source above was read on 26 September 2026.

What this looks like in practice.

Reading about continuous evidence is one thing. Watching a control get tested against live data from your own stack is another. A 30 minute walkthrough on your frameworks shows the difference.

Request a demo