Third-Party Risk Management: Suppliers, Service Providers and Subcontractors

Why third-party risk is rising#

Cloud hosting, online software, call centres, payment service providers, AI vendors: a growing share of critical activities depends on third parties. Accountability, however, cannot be outsourced. If a provider loses your customers' data, it is your company that customers and the regulator hold responsible.

Step 1: build the inventory#

List every third party, including those paid by card or used free of charge: online tools, messaging apps, IT service providers, sales agents, intermediaries.

Step 2: rank by criticality#

Step 3: carry out due diligence#

The depth depends on criticality. For a critical third party, check in particular:

• financial health and reputation;
• legal compliance and track record;
• corruption risk, particularly for intermediaries and agents;
• IT security (certifications, penetration tests, incident management);
• where data is hosted and any transfers abroad;
• for an AI vendor, the system documentation and the allocation of responsibilities.

Step 4: secure the contract#

The essential clauses:

• Personal data: a written contract requiring the processor to follow your instructions and keep the data secure, as required by Articles 23 and 24 of Law 09-08.
• Location and transfers: the hosting location, and compliance with Articles 43 and 44 of Law 09-08 in the event of a transfer.
• Audit rights and access to information.
• Onward subcontracting subject to your approval.
• Service levels and penalties.
• Incident notification within a short timeframe.
• Reversibility: return of data and assistance when the contract ends.

Step 5: monitor over time#

Review critical third parties at least once a year: incidents, service levels, changes in their situation, changes of subcontractors. A supplier assessed only once, at signing, is not a supplier under control.

Step 6: plan the exit#

Plan from the outset how you will exit: return of data, deletion at the provider, transfer to a new supplier, without service disruption.

Rules specific to Morocco#

• Law 09-08: a written contract with each processor, and safeguards for transfers abroad. See transferring data abroad.
• Banks: the Bank Al-Maghrib directive of 19 May 2022 on cloud outsourcing requires, among other things, prior approval for material outsourcing and audit rights.
• Critical infrastructure entities: Law No. 05-20 and Decree No. 2-24-921 require the use of qualified cloud service providers for sensitive systems.
• AI vendors: ISO/IEC 42001 provides for a clear allocation of responsibilities with suppliers and customers throughout the system lifecycle.