Central banks frequently provide systemic payments and financial infrastructure services. And to do so, they often contract third parties for services. This is sometimes related to the development of closely monitored real-time gross-settlement systems or critical payment rails. Or it can be for the provision of IT equipment, internet services or other, more typical, outsourced services.

It is often a challenge to understand and manage risks related to third parties. But the problem is