Third-Party Risk Management And Vendor Assessment
Evaluate Vendor Risk, Contracts, and Supply Chain Exposure
Hours
Lectures
Content
About This Course
A vendor can become your organization’s biggest risk if you don’t know what to look for. Third-Party Risk Management and Vendor Assessment gives you a practical framework for evaluating vendors from onboarding through ongoing monitoring and offboarding. You’ll cover vendor classification, due diligence, risk scoring, contracts and SLAs, cybersecurity evidence, U.S. compliance requirements, cloud and SaaS risk, business continuity, fourth-party risk, audits, corrective actions, AI vendor risk, and software supply chain exposure. By the end, you’ll be able to assess vendor risk, identify control gaps, review evidence, and document stronger risk decisions.
What You'll Learn
- Define third-party risk and understand its impact on organizations
- Classify vendors and apply risk-based tiering
- Assess inherent and residual risk across vendor relationships
- Manage vendor inventories, due diligence, contracts, and SLAs
- Understand key U.S. requirements, including GLBA, HIPAA, SEC, and NYDFS Part 500
- Evaluate SOC 2, ISO 27001, NIST, cloud, and SaaS security evidence
- Apply risk scoring, vendor audits, corrective actions, and ongoing monitoring
- Assess business continuity, fourth-party, AI vendor, and software supply chain risks
Requirements
- No prior legal, compliance, or technical security experience required
- Basic familiarity with vendors, procurement, or contracts is helpful but not required
- Willingness to work with assessments, scoring tools, contracts, and case scenarios
- Suitable for professionals across finance, healthcare, insurance, technology, operations, and government
- Reliable internet access and a computer, tablet, or mobile device
This Course Includes
- 6 hours of self-paced online learning
- Practical contract review guides and SLA evaluation worksheets for everyday use
- Downloadable vendor risk assessment templates and due diligence checklists
- Knowledge checks and learning assessment
- Full mobile and desktop access,
- Certificate of Completion
Who Is This Course For?
This course is designed for procurement professionals, compliance officers, risk analysts, IT managers, and operations leaders responsible for vendor oversight. It also benefits executives and team leads seeking a clear understanding of third-party risk management and how vendor decisions affect regulatory compliance, data security, financial stability, and overall organizational resilience across regulated industries.
Certification
Compliance and Regulatory Alignment
This course aligns with major 2026 U.S. regulatory expectations surrounding third-party risk management, including GLBA safeguards, HIPAA business associate obligations, SEC Regulation S-P, and NYDFS Part 500 requirements. Learners also gain familiarity with state breach notification laws, NIST supply chain guidance, SOC 2 reporting, and ISO 27001 standards used to evaluate vendor security posture nationwide.
Why Compliance Training Matters
Weak vendor oversight remains a leading cause of data breaches, regulatory penalties, and costly operational disruptions. Strong third-party risk management training helps organizations catch problems early, document due diligence properly, and respond confidently during audits. As vendor ecosystems grow more complex—especially with AI-powered tools and cloud-based services—proactive training protects both organizational reputation and financial performance.
Career Benefits
Professionals skilled in third-party risk management are in high demand across banking, healthcare, insurance, and technology sectors. Employers increasingly value individuals who can assess vendors, review compliance evidence, and manage risk registers with confidence. This expertise strengthens your résumé. supports promotions into risk and compliance leadership roles, and significantly increases your long-term value within vendor management and enterprise risk functions.
Course Curriculum
24 •6 Hours
Module 1: Foundations of Third-Party Risk
-
Third-Party Risk Defined
-
Vendor Types and Categories
-
Inherent and Residual Risk
-
Governance and Accountability
Module 2: Vendor Lifecycle Risk Governance
-
Vendor Inventory and Classification
-
Due Diligence and Tiering
-
Contract Controls and SLAs
-
Monitoring and Offboarding
U.S. Vendor Compliance Requirements
-
Banking and GLBA Rules
-
HIPAA Business Associate Rules
-
SEC and NYDFS Oversight
-
Privacy and Breach Laws
Module 4: Cybersecurity and Data Protection
-
NIST Supply Chain Risk
-
Access and Data Controls
-
Cloud and SaaS Risk
-
SOC 2 and ISO Evidence
Operational Vendor Risk Domains
-
Business Continuity Risk
-
Financial and Insurance Risk
-
Ethics and Compliance Risk
-
Fourth-Party Risk
Module 6: Advanced Vendor Assessment Methods
-
Risk Scoring Models
-
Audit and Corrective Actions
-
AI Vendor Risk
-
Software Supply Chain Risk
Frequently Asked Questions
Third-party risk management is the structured, ongoing process of identifying, evaluating, scoring, and monitoring risks that arise from working with outside vendors, contractors, and service providers. It matters because vendor failures can quickly lead to data breaches, regulatory violations, financial losses, and serious operational disruptions affecting customers, employees, and partners alike.
Vendor risk is assessed based on factors such as data access, service criticality, regulatory exposure, financial impact, cybersecurity controls, and business continuity requirements.
Key regulations include GLBA for financial institutions, HIPAA for healthcare-related business associates, SEC Regulation S-P, and NYDFS Part 500 for cybersecurity programs. Numerous state breach notification laws also apply, making consistent third-party risk management essential for navigating overlapping compliance obligations across jurisdictions.
The frequency should be based on vendor risk. High-risk or critical vendors generally require more frequent reviews, while lower-risk vendors may follow less frequent assessment cycles.
No. No prior technical, legal, or compliance experience is required. The course explains technical concepts such as cybersecurity evidence, SOC 2, ISO 27001, cloud risk, and AI vendor risk in a practical way.
Yes. You will receive an official certificate of completion after successfully completing the course, recognizing your knowledge of third-party risk management and vendor assessment.