A phrase forged during the Cold War. A principle that quietly became the foundation of modern Third-Party Risk Management.
In the Cold War era, trust without verification was dangerous, and verification without trust was destabilising. Agreements were signed, but inspections followed. Commitments were made, but evidence was required. The balance between the two prevented catastrophic miscalculation.
Decades later, the geopolitical context has changed. The logic has not.
In today’s digital economy, organisations rely on an extended ecosystem of suppliers, cloud providers, integrators, software vendors, and service partners. We trust them with our data, our operations, sometimes even with our ability to deliver products and services. Without that trust, business would grind to a halt.
But trust alone is no longer a control.
Modern GRC, and especially Third-Party Risk Management (TPRM), is built on the same Cold War lesson: trust must be paired with verification. Not because suppliers are assumed to be untrustworthy, but because risk is systemic, shared, and often invisible until it materialises.
This is why regulators, boards, and insurers now ask different questions:
How do you know your critical suppliers actually apply the controls they claim?
How do you manage subcontractors you do not contract directly with?
How quickly would you be informed if a key provider is compromised?
What happens operationally if a “trusted” partner suddenly fails?
Frameworks and regulations like NIS 2, DORA, and ISO 27001 are explicit on this point. Accountability does not stop at your perimeter. Responsibility cannot be outsourced.
So how do you turn “trust, but verify” into something operational?
By making it an action plan, not a slogan.
Start by segmenting suppliers by criticality, based on real business impact, not procurement spend. For each tier, define clear verification expectations: evidence over declarations, proportionate to risk. Embed security, resilience, and audit rights directly into contracts, including incident notification timelines, RTO/RPO commitments, and obligations on subcontractors.
Then operationalise it:
Assign a single accountable owner per critical supplier.
Maintain a living risk profile with tracked remediation actions and deadlines.
Review high-risk suppliers on a fixed cadence, not only at contract renewal.
Escalate unresolved risks at executive level when business exposure justifies it.
Periodically test assumptions through access reviews, resilience tests, or joint tabletop exercises.
This is not about bureaucracy. It is about professionalising trust.
Organisations that apply this mindset do not slow the business down. They reduce uncertainty, avoid unpleasant surprises, and make informed trade-offs between speed, cost, and risk. They move from blind confidence to controlled confidence.
Trust, but verify. It helped prevent nuclear escalation. It still helps prevent cyber, operational, and business crises.