Lion Cipher Lab
Conduct a vendor security review
- GRC / Compliance
- Beginner
- ~50 min
- Free · no account required
Why it matters
Almost every organization now runs on other companies' software: the payroll SaaS, the email provider, the analytics tool, the cloud host behind all of them. Each one you trust is a door into your data, and their breach becomes your breach — this is the supply-chain path attackers keep using because it is easier to compromise one popular vendor than a thousand customers directly. Deciding which vendors to trust, and on what conditions, is third-party risk management, and it is one of the most common tasks handed to a new GRC analyst. The skill is not paranoia; it is proportion — gather the…
What you'll learn
- third-party risk management (TPRM)
- vendor security review
- reading SOC 2 and ISO 27001 signals
- identifying sub-processors and data residency
- risk scoring by data sensitivity and access
- writing a one-page vendor risk assessment
- making a defensible approve / conditions / reject decision
Steps in this lab
- The words this lab runs on
- Why their breach becomes your breach
- Pick a real vendor and set the scope
- Gather evidence: the trust page and the audit reports
- Gather evidence: sub-processors, data location, and the DPA
- Gather evidence: breach history and track record
- Score the risk and make the call
- What you just built - and the honest limit of it