Third-Party Risk Management (TPRM) is the process of identifying, assessing, and controlling the risk that vendors, suppliers, contractors, and partners introduce when they touch an organization’s systems or data. The hard truth behind it: you can outsource the work but not the accountability. When a vendor is breached and your customers’ records leak, regulators and headlines still point at you.
A working program vets a vendor before onboarding through security questionnaires, audits, and evidence like a SOC 2 report, writes concrete security obligations into the contract, and then keeps watching rather than filing the assessment away. That last part is where many programs fail. They treat vendor review as a one time gate at signing, so a supplier whose security decays two years later goes unnoticed until the incident. Continuous monitoring and clear offboarding close that gap.
How is third-party risk management tested on the CISSP?
TPRM sits in Domain 1 (Security and Risk Management), the heaviest domain at sixteen percent. Expect questions on vendor assessment, contractual security requirements, and supply chain risk within enterprise risk management. See Domain 1: Security and Risk Management for the governance material.