Lion Cipher Lab
Build a third-party risk management (TPRM) program
- GRC / Compliance
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Almost every serious breach now has a supply-chain angle: SolarWinds, Log4j, the MOVEit mass-exploitation, the xz-utils backdoor. Your attack surface is no longer just your own systems — it's every vendor with a login, an API key, or a copy of your data, plus their vendors underneath them. You can outsource the work to those vendors, but you can never outsource the accountability: when their breach spills your customers' data, it's your name in the headline and your regulator on the phone. A TPRM program is how a security team stops treating vendors as an afterthought and starts risk-ranking…
What you'll learn
- third-party risk management
- vendor tiering
- supply-chain risk
- due diligence
- continuous monitoring
- C-SCRM
Steps in this lab
- What a TPRM program is — and where it sits
- Step 1 — Build the inventory (you can't protect what you can't list)
- Step 2 — Tier by risk, because you cannot deeply assess everyone
- Step 3 — Due diligence: questionnaires, evidence, and when to stop trusting the form
- Step 4 — Contractual controls: write the risk into the paper
- Step 5 — Continuous monitoring: the part most programs skip
- Step 6 — Offboarding: the risk doesn't end when the contract does
- The judgment that holds it together — outsource the work, never the risk