TPSA Framework Overview

Architecture

TPSA addresses a fundamental gap in third-party security governance: suppliers are assessed, but have no standard mechanism to respond. The framework provides that mechanism structured, bidirectional, and aligned to existing regulatory obligations.

The four documents form an integrated whole. TPSA-01 defines what to disclose; TPSA-02 defines how to dialogue about risk; TPSA-03 proves regulatory coverage; TPSA-04 ensures independent verification of conformance.

Two-Layer Disclosure Architecture

TPSA-01 introduces a two-layer model that balances transparency with confidentiality:

• Common Disclosure shared infrastructure controls, published for all clients. Covers the supplier's baseline security posture across all 7 domains.
• Client-Specific Annexes per-client overlays for dedicated assets, data classification overrides, and tailored SLAs. Confidential to the individual client relationship.

EBIOS RM Integration

TPSA-02 maps directly onto the five EBIOS Risk Manager workshops:

• WS1 (Scope) pre-populated from the Disclosure Card
• WS2 (Risk Sources) client submits SR/OV pairs via RSC Section A
• WS3–4 (Scenarios) client constructs MITRE ATT&CK scenarios mapped to supplier assets
• WS5 (Treatment) joint risk treatment plan from SRA response

TIBER-EU Integration

At TPSA Full level, the framework integrates directly with DORA Article 26 TLPT exercises. The Disclosure Card's structured asset register dramatically accelerates TIBER-EU scoping; RSCs already submitted provide input for test scenario design.