Third-party risks should be managed by conducting thorough due diligence on all ICT service providers, including assessing their operational resilience, security practices, and compliance with DORA requirements. Contracts should clearly outline the responsibilities of third parties in maintaining operational resilience and reporting incidents.