SIG (Shared Assessments) B: Manage the risk of the third party's own vendors (fourth and Nth parties)

SIG risk domain B, Nth Party Management. The third party runs its own third-party risk program over the subcontractors that support the service: it identifies fourth and Nth parties, assesses and monitors them in proportion to risk, flows down contractual obligations and responds to its customers' due diligence on its supply chain. Since 2023 these questions sit in their own risk domain.