The process of evaluating and managing the cybersecurity risks associated with third-party vendors and service providers who have access to an organization's data or systems.