Third-party and supply chain risk
You tier suppliers by criticality, assess them with questionnaires and assurance reports, and manage risk through contracts and ongoing monitoring.
Level 301 · 20 lessons · 18 practice labs
Lessons
Foundations
- Third-party risk: suppliers come in through your door: You can explain with examples how suppliers with access to your data and systems bring risk inside.
- Lessons from supply chain incidents: You draw lessons for your organisation from major incidents caused by software updates, managed services and file transfer tools.
- The supplier risk management lifecycle: You plan which security step happens at each stage of a supplier relationship, from selection to exit.
- Quick task: a supplier lifecycle checklist
Assessment
- Supplier inventory and criticality tiers: You tier all suppliers by data access and business impact and set the depth of assessment to match.
- Pre-contract due diligence: You carry out the steps to vet a supplier for security, financial standing and compliance before choosing them.
- Security questionnaires: SIG, CAIQ and your own questions: You adapt standard questionnaire templates and prepare a short, focused set of questions for each supplier tier.
- Reading assurance: SOC 2 reports and ISO/IEC 27001 certificates: You check a SOC 2 report’s scope, exceptions and user responsibilities, and a certificate’s scope and validity.
- Validating answers: asking for evidence and outside-in signals: You compare a supplier’s claims with documents, screenshots and externally visible security signals.
- Quick task: tier a supplier list
Contracts and monitoring
- Security clauses: notification, right to audit, subcontractors: You can draft a contract annex covering incident notice, right to audit, subcontractor approval and data return.
- Continuous monitoring and reassessment: You set up triggers and a reassessment schedule to follow a supplier’s security status all year.
- Fourth parties and concentration risk: You spot shared services your suppliers rely on and make over-reliance on a single provider visible.
- Limiting supplier access: remote access, accounts, segregation: You make supplier accounts named, time-limited and logged, with access only to the systems they need.
- Quick task: find the missing security clauses in a contract
Software supply chain and exit
- Software supply chain: SBOMs and signed releases: You can request and assess a software bill of materials (SBOM) and signed-release assurance for software you buy.
- When a supplier has an incident: joint response: You coordinate fact-finding, access restriction and communication when a supplier has an incident.
- Leaving a supplier: closing access, returning and destroying data: When a contract ends, you verify with evidence that access is closed and data returned or destroyed.
- Regulatory expectations: NIS2, DORA and public tenders: You prepare the records and evidence regulators and public buyers expect for supply chain security.
- Capstone: assess a critical cloud supplier and write a decision report: You review a fictional supplier’s answers, assurance report and contract and recommend approval, conditional approval or rejection.
Practice labs
- Place activities in the lifecycle: Place fifteen activities in the selection, contracting, onboarding, monitoring and exit stages.
- Tier a supplier list: Sort thirty suppliers into three tiers by data access, service criticality and ease of replacement.
- Find the suppliers missing from the inventory: Compare a payments export and a single sign-on application list with the supplier inventory and report unrecorded services.
- Choose the question set by tier: Decide whether six suppliers get the short, standard or detailed questionnaire.
- Assess the questionnaire answers: Mark the weak, evasive and contradictory answers in a cloud backup provider's forty-question response.
- Validate answers with evidence: Compare a supplier's statements with the policy, test summary and outside-in configuration records it supplied and list what cannot be confirmed.
- Read the scope of a certificate: Find the scope, validity and certification body in three ISO/IEC 27001 certificates and state whether the service you buy is covered.
- Assess the exceptions in a SOC 2 report: Assess the exceptions and management responses in the test results of a fictional Type 2 report from your own risk viewpoint.
- Map the complementary user controls: Map the complementary user entity controls in a report to your own control list and report the ones you do not meet.
- Find the missing security clauses: Compare a service contract with a checklist of notification, audit right, subcontractor and data return clauses.
- Strengthen the incident notification clause: Rewrite a clause that says notification within a reasonable time with a deadline, content, contact point and duty to cooperate.
- Limit supplier access: Review a maintenance firm's remote access accounts and connection records and report shared accounts, open-ended access and needless network reach.
- Set the reassessment dates: For twenty suppliers, find the overdue ones and set the next date from tier and last assessment date.
- Map the fourth parties: From the subcontractor lists of ten critical suppliers, produce a table of shared dependencies.
- Assess concentration risk: For a portfolio where over half the critical services rest on one cloud region, assess the risk and write the mitigation options.
- Find the component in an SBOM: In a prepared software bill of materials, find the version of a given library and the products that use it.
- Verify a signed release: Verify the hash and signature of a supplier's release file against the published values.
- An exit plan for a supplier: Write an exit plan for Kuzeyyıldızı Kargo leaving its route-planning provider, covering access closure, data return and confirmation of destruction.
About this course
You tier suppliers by criticality, assess them with questionnaires and assurance reports, and manage risk through contracts and ongoing monitoring.
What you will learn
- Foundations
- Assessment
- Contracts and monitoring
- Software supply chain and exit
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.