We chose to use the two terms to differentiate between the concepts of a contracted service provider (i.e., a vendor) and, more broadly, any external entity with whom the organization has a relationship (i.e., a third party). In other words, all vendors are third parties, but not all third parties are vendors.
