Vendor Risk Management: Building a Third-Party Assessment Program

Third-party risk is one of the most undermanaged areas in organizational security. Every vendor with access to your systems or data is an extension of your security perimeter. When they have a breach, you have a problem. When they have weak controls, you carry the exposure. And when regulators, auditors, or customers ask how you manage vendor risk, you need a real answer — not a general reassurance.

This course walks you through building a vendor risk management program from the ground up. You will learn how to inventory and tier your vendors, design a practical assessment process, structure contracts to protect your organization, and build ongoing monitoring into your operations rather than treating vendor review as a one-time event.

Whether you are starting from nothing or trying to mature a program that exists only on paper, this course gives you a framework grounded in what actually works — not theoretical best practices that no operational team can sustain.

No prior compliance experience required.

Who This Is For

• Security and compliance professionals building a third-party risk program from scratch or maturing an existing one
• Procurement and vendor management teams who need a security lens on their process
• Organizations preparing for SOC 2, ISO 27001, or other audits that include vendor oversight requirements
• Anyone who has been asked "how do you manage vendor risk?" by an auditor or customer and didn't have a good answer