Third-Party Risk in 30 Minutes, Not 30 Days: A Fast Triage Method for Every New Tool

In a hospital emergency department, the first person you meet is not a surgeon. It is a triage nurse who decides, within minutes, who needs a doctor now and who can wait. That brief decision keeps the surgeons free for the patients who need them. This guide gives your team the same discipline for software: a 30-minute third-party risk assessment triage that sets the right review depth for every tool and leaves a record an auditor can follow.

Why third-party risk queues stall

Queues rarely stall because reviewers are slow. They stall because every request enters the same funnel. A note-taking app and a payroll platform receive the same questionnaire, while the one request that needs expert attention waits behind twenty that never did.

Three causes recur. Intake forms ask what a tool is called rather than what it touches. Reviewers gather evidence before deciding how much is needed. And nobody has written down when moving quickly is acceptable, so teams buy on a company card instead.

The stakes are real. Verizon's 2025 Data Breach Investigations Report found third parties involved in 30% of breaches, double the previous year. NIST Cybersecurity Framework 2.0 expects suppliers to be known and prioritised by criticality. Triage is how that expectation works in practice.

The 30-minute routine

Run the triage as a fixed routine with a timer, ideally by one analyst using a standard form. If facts are missing, the clock stops and the request returns to its owner.

• Minutes 0 to 5, intake check: confirm the business owner, use case, data, users and integrations are stated.
• Minutes 5 to 15, impact questions: answer the three questions below from the form and public documentation.
• Minutes 15 to 20, tripwires: scan for facts that raise the tier regardless of the count.
• Minutes 20 to 25, evidence reuse: check for a prior assessment, SOC 2 report, ISO/IEC 27001 certificate or completed CAIQ, the Cloud Security Alliance questionnaire.
• Minutes 25 to 30, decision: set the tier, approver and next step, and write the two-line record.

The three impact questions

Write a definition for each question and publish it beside the intake form. Sensitive data means personal or customer data, credentials, source code, financial records or unreleased plans. Critical means one day of downtime would stop revenue, payroll, customer service or a regulated process. Connected means write access to core systems, administrator rights, broad mail or file permissions, or an installed agent.

Count the yes answers. None sets the low tier, one sets medium, and two or three set high.

Tripwires that override the count

Some facts raise the tier by at least one level, whatever the count. Examples include an AI feature with unclear training use of your content, and permissions such as read all mail. Others are a missing sub-processor list, regulated data such as health or payment card data, and personal accounts connected to company data.

What each tier should trigger

The tier saves time only if each level has a fixed, published response. The turnaround targets below are internal service goals, not industry rules.

Reuse evidence wherever possible, but read it first. Check that it is current and that its scope covers the product you are buying. A SOC 2 Type II report, an independent auditor's report on how controls operated over a period, outweighs a point-in-time Type I. If any check fails, record the gap and raise the tier.

A worked example: one Monday's intake queue

Here is a hypothetical queue of six requests received on the same morning, triaged with the routine above.

Now the arithmetic, using hypothetical effort figures. Full reviews of 12 analyst hours each would cost 72 hours. With triage, six triages take 3 hours, the two medium requests need 3 hours each and three full reviews need 36 hours. The total is 45 hours.

The real gain lies in where those hours go. Most now land on the three tools that could cause harm. Two of those, the transcription tool and the browser extension, would have looked harmless on a list of names.

Keeping fast triage sound

Four habits keep the method sound. Requesters supply facts, but the analyst applies the rule. Every decision, especially a quick approval, receives a two-line record of the tier, the deciding facts, the approver and the next review date. A tool that adds an AI feature or new integration is triaged again. And a high tier begins a full review rather than ending one.

Volume will not fall. The 2024 Work Trend Index from Microsoft and LinkedIn found that 78% of AI users bring their own AI tools to work. A triage that clears simple requests the same day keeps people inside the process.