// GLOSSARY

Third-party Trust Pressure

The continuous burden of providing evidence created by the security-posture assessments an organization undergoes from its customers, business partners or regulator. It is the trigger of the portable-assurance line (S4-A). The concept names a role change security has gone through in recent years: security is no longer only a matter of an organization protecting itself but of proving to others that it is trustworthy. As supply-chain attacks rose, organizations realized that every supplier they work with is a risk gateway; so before buying a service they now question that supplier's security posture. This pressure is continuous, because every new customer, every new partnership and every contract renewal demands the evidence be presented anew. It is not the same as audit and regulation pressure (S4-B), and the difference is in the counterpart: third-party trust pressure arises from the commercial question 'can we work with you, can we trust you'; audit pressure from 'is the legal requirement met'. The strategic consequence of this pressure is this: security stops being an activity of the technical team and becomes a condition of the sales and partnership table; the matter is no longer only being secure but being able to prove it at any moment.