About the Course
Organizations do not get judged on intent in third-party cyber risk management. They get judged on whether they can prove they know which vendors hold sensitive data, which providers touch critical services, and which relationships create unacceptable residual risk. To do that credibly, you need to demonstrate vendor inventory discipline, risk tiering, due diligence review, control validation, contract risk review, and continuous monitoring, all of which map naturally to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0, and shared responsibility thinking across the supplier ecosystem.
This third-party cyber risk management training turns fragmented vendor oversight into a structured operating model. You will practice building a third-party inventory, drafting a risk classification model, evaluating security questionnaires, mapping contractual control expectations, and creating a monitoring dashboard that leadership can act on. You will also be introduced to AI-assisted vendor screening, external attack surface signals, and automated workflow tools at an operational level so you can understand where they fit without overpromising their maturity in your environment. This course teaches third-party cyber risk management through practical templates and case-based exercises so you can produce vendor risk registers, assessment summaries, remediation trackers, and board-ready reporting.
The course is built for professionals who must deliver under real constraints, including limited supplier visibility, inconsistent questionnaire quality, procurement pressure, repeated renewals, and uneven maturity across business units. It is especially relevant when you need to balance speed of onboarding with security assurance, maintain defensible records for audits, and align procurement, legal, security, and business owners without slowing operations unnecessarily.
Target Audience
This course is built for professionals who already touch vendor oversight, cyber governance, procurement controls, or security assurance and now need a structured third-party cyber risk management approach.
- Third-Party Risk Analysts tracking vendor security posture and tiering decisions
- Cyber Risk Managers defining assessment scope and residual risk treatment
- Vendor Governance Leads coordinating supplier reviews and remediation tracking
- Procurement Specialists embedding cyber clauses into supplier onboarding
- Information Security Officers validating control expectations across external service providers
- GRC Analysts maintaining questionnaire evidence and risk registers
- Third-Party Due Diligence Coordinators managing intake and escalation workflows
- Compliance Managers aligning supplier oversight with ISO/IEC 27001:2022 expectations
- IT Vendor Managers monitoring renewal risk and service criticality
- Business Continuity Managers reviewing supplier dependency and resilience exposure
Course Objectives
This course equips you to plan, execute, and measure third-party cyber risk management initiatives that reduce vendor exposure, strengthen control oversight, and support defensible reporting.
- Assess vendor exposure using a third-party risk register and criticality scoring model.
- Apply risk-tiering methods to supplier due diligence and onboarding decisions.
- Design a vendor questionnaire aligned with ISO/IEC 27001:2022 control expectations.
- Build a remediation tracker for security gaps, exceptions, and compensating controls.
- Evaluate supplier controls against NIST Cybersecurity Framework 2.0 and contract clauses.
- Navigate procurement, legal, and security approvals for high-risk vendor relationships.
- Implement continuous monitoring indicators using external attack surface and scorecard data.
- Synthesize findings into executive dashboards and board-ready third-party risk reports.
Requirements & Prerequisites
Participants should have working knowledge of cybersecurity fundamentals, vendor or procurement processes, and basic risk concepts such as likelihood, impact, and residual risk. Prior exposure to ISO/IEC 27001:2022, NIST Cybersecurity Framework 2.0, or enterprise third-party due diligence processes is helpful but not mandatory. No programming is required, and all analytics activities use guided spreadsheets, templates, and reporting artifacts. The course works best for professionals who already review suppliers, assess controls, or support governance, risk, and compliance workflows.
Local Application and Business Return in your market
How participants can apply the training in local operating conditions, and the return their organisation can plan for.
How participants apply this
Expected ROI
Training Methodology
This is a practical, outcome-driven course designed to turn third-party cyber risk management aspiration into measurable action and credible reporting.
Methodology includes:
- Calculate vendor risk scores using a guided third-party risk register and weighted scoring sheet.
- Simulate a high-risk SaaS onboarding decision with security, procurement, and legal constraints.
- Assess a supplier against ISO/IEC 27001:2022-aligned due diligence and control checklist.
- Map stakeholders, approvals, and escalation paths across procurement, security, legal, and business owners.
- Analyze case patterns from financial services, healthcare, technology, and manufacturing supply chains.
- Build a remediation tracker and monitoring dashboard under time and budget constraints.
- Review benchmark evidence from vendor scorecards and external exposure signals to challenge current practice.
Upcoming Sessions
Next available dates worldwide
No international sessions scheduled
Certification
Recognized credentials that advance your career
Participants who complete the Third-Party Cyber Risk Management Training Program earn a Trainingcred Certificate of Achievement, demonstrating professional competence and alignment with global standards in learning and development.
NITA Accredited
Accredited by the National Industrial Training Authority, ensuring programs meet nationally recognized standards of quality and relevance.
CPD Certified
Recognized by the CPD Certification Service, ensuring every program meets internationally benchmarked standards of professional excellence.
Why this course earns its place on your CV
Accredited training, practitioner trainers, and peers on the same career track — the three things real expertise is built on.
Effective Learning & Skill Development
- Build expertise with structured, outcome-driven learning.
- Equip individuals and teams with skills that grow with industry needs.
- Reinforce learning through real-world scenarios, case studies and practical exercises.
Career Growth & Professional Advancement
- Apply what you learn with a proven methodology that ensures lasting impact.
- Develop immediately usable skills that translate directly into workplace success.
- Gain the expertise needed for career advancement and leadership roles.
Training Optimization & Learning Excellence
- Tailor training to industry-specific challenges and organizational goals.
- Use data-driven insights and automation to enhance training effectiveness.
- Evaluate progress and ensure long-term learning success.
Tools and platforms relevant to this field
Examples local teams may encounter, and that may be featured in training where they support the confirmed course scope.
These are field-relevant examples, not a promise that every tool will be covered. Exact coverage depends on the confirmed course scope, participant needs, and delivery format.
-
ServiceNow Vendor Risk Management ServiceNowUsed to centralize vendor assessments, track remediation, and maintain a repeatable third-party risk workflow across procurement and security teams.
-
BitSight Security Ratings BitSightUsed for continuous external monitoring of vendor cyber posture and to help prioritize suppliers that require deeper review.
-
OneTrust Third-Party Risk Management OneTrustUsed to manage due diligence questionnaires, risk tiering, approvals, and ongoing vendor reassessments in a single workflow.
-
Archer Third-Party Risk Management ArcherUsed by governance, risk, and compliance teams to document vendor inventories, control gaps, and executive-level risk reporting.
