Research library / 06 guides
Third-party risk management
Practical perspectives on vendor security, operational resilience and AI risk.
The essential guides
What is third-party risk management? A practical starting guide
Build a practical TPRM program with a vendor inventory, risk tiers, evidence reviews, accountable decisions and ongoing monitoring.
Vendor risk assessment checklist: from intake to approval
A decision-led vendor risk assessment checklist covering data, access, evidence, continuity, contracts and residual risk.
Vendor security questionnaires: 15 questions worth asking
Fifteen service-scoped vendor security questions with guidance on evidence, follow-ups and handling incomplete answers.
Continuous vendor risk monitoring: signals that lead to action
Design risk-based vendor monitoring with scheduled reviews, event triggers, signal validation and actionable escalation.
DORA and ICT third-party risk: a practical operating map
Understand DORA's ICT third-party risk scope, service records, critical functions, contracts, oversight and exit planning.
AI vendor risk assessment: follow the data and the decision
Assess AI suppliers by use case, sensitive data, model dependencies, output reliability, security controls and human oversight.