> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing.md).

# 4th party sharing

**SaaS security problem**

Third-party collaborators can share your data with fourth-party collaborators such as their own vendors, exposing your data to unauthorized personnel who have not passed any security risk assessment. It’s extremely complex to implement consistent policies that prevent fourth-party sharing across all SaaS apps.

**DoControl solution**

DoControl addresses the threat model of 4th party sharing by providing your organization with the tools to monitor, mitigate, and remediate the associated risks.

DoControl leverages these tools to automatically monitor, mitigate and remediate the risks associated with 4th party sharing across a variety of apps:

* [Alerts](#alerts-for-4th-party-sharing)
* [Playbooks](#playbooks-for-4th-party-sharing)

## What is 4th party sharing?

4th party data access occurs when an external party to your company shares your files or data with another party that is external to them.

## What's the risk?

Some 4th party access can be legitimate and necessary. However in too many cases, 4th party access is a result of careless or unintended data access, opening the company to potential data exfiltration, since data is shared with an unvetted party.

## Alerts for 4th party sharing

DoControl alerts automatically notify your organization when anomalous user behavior occurs.  Alert types for external sharing indicate excess permission privileges that were granted to external users outside your organization.

To mitigate the risk of exposed data as a result of 4th party sharing, DoControl provides these alerts:

<table><thead><tr><th width="131.33333333333331">Alert type</th><th width="246">DoControl alert name</th><th>Alert description</th></tr></thead><tbody><tr><td>DC10</td><td>External user shared with 4th party</td><td>This alert will trigger when a third party (an external user) shares an asset with someone who is not part of your organization.</td></tr></tbody></table>

{% hint style="info" %}
For details about DoControl alerts, go to **Help > DoControl Alert Specifications**.
{% endhint %}

### How to remediate alerts?

If your organization receives alerts notifying you of 4th party sharing, you can remove external collaborators on-demand using the **Remove external collaborator** inventory action.&#x20;

{% hint style="info" %}
You can apply inventory actions to remove external collaborators from assets in these SaaS apps:

* [Box](/docontrol-user-guide/workflows/inventory-actions-quick-actions/box-inventory-actions.md)
* [Google Drive](/docontrol-user-guide/workflows/inventory-actions-quick-actions/google-drive-inventory-actions.md)
* [OneDrive](/docontrol-user-guide/workflows/inventory-actions-quick-actions/onedrive-inventory-actions.md)
* [SharePoint](/docontrol-user-guide/workflows/inventory-actions-quick-actions/sharepoint-inventory-actions.md)
  {% endhint %}

## Playbooks for 4th party sharing

To address the use cases of 4th party sharing across various SaaS apps, you can define automated workflows with DoControl's out-of-the-box playbooks. These playbooks will:

* Notify your security team whenever an asset is shared with a 4th party (immediately or after a given time frame)
* Prevent third parties from sharing assets with unvetted parties
* Automatically remove external collaborators

<figure><img src="https://3236294211-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MesrnyDMZGYg1V-tOBo%2Fuploads%2FDCTUsNdmg2Ix1gSqlDBM%2F4th%20party%20playbooks.png?alt=media&amp;token=f62082d7-9e1e-4a77-9cde-a582032a559c" alt=""><figcaption><p>Select a predefined DoControl playbook to remediate 4th party sharing</p></figcaption></figure>

<table><thead><tr><th width="304">Playbook name</th><th width="169.33333333333331">SaaS app</th><th>Playbook description</th></tr></thead><tbody><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/encryption-key-sharing/box-playbooks-for-encryption-key-sharing.md">Notify on 3rd party sharing with 4th party</a></td><td>Box</td><td>When a 3rd party shares with a 4th party in Box, the security team is notified by Slack.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing/google-drive-playbooks-for-4th-party-sharing.md#notify-on-3rd-party-sharing-with-4th-party">Notify on 3rd party sharing with 4th party</a></td><td>Google Drive</td><td>When a 3rd party shares with a 4th party in Google Drive, the security team is notified by Slack.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing/google-drive-playbooks-for-4th-party-sharing.md#revoke-3rd-party-sharing-with-4th-party">Revoke 3rd party sharing with 4th party</a></td><td>Google Drive</td><td>When a 3rd party shares an asset with a 4th party in Google Drive, the SecOps team is asked to approve the sharing. If the SecOps team does not approve, 4th party collaborators are automatically removed from the asset.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing/onedrive-playbooks-for-4th-party-sharing.md">Revoke 3rd party sharing with 4th party</a></td><td>OneDrive</td><td>When a 3rd party shares with a 4th party in OneDrive, the security team is notified by Slack, and external collaborators are removed from the asset.</td></tr><tr><td><a href="/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing/sharepoint-playbooks-for-4th-party-sharing.md">Revoke 3rd party sharing with 4th party</a></td><td>SharePoint</td><td>When a 3rd party shares with a 4th party in SharePoint, the security team is notified by Slack, and external collaborators are removed from the asset.</td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/4th-party-sharing.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.