Topics in this domain
- The Security Program: Charter, Scope and Objectives
- Security Team Structure, Roles and Staffing
- Working with Legal, HR, IT, Audit and the Business
- Program Implementation: From Plan to Operating Controls
- Information Asset Identification and Valuation
- Data Classification: Owners, Custodians and Users
- Data Lifecycle: Retention, Archiving and Secure Disposal
- Enterprise Architecture for Security Managers
- Information Security Architecture: Principles and SABSA
- Defence in Depth and Zero Trust
- Cloud Security and Shared Responsibility
- Control Frameworks: NIST SP 800-53, CIS Controls and ISO 27002
- Security Policy Development and Lifecycle
- Security Standards and Baseline Requirements
- Procedures, Guidelines and Acceptable Use
- Policy Enforcement, Exceptions and Review
- Designing Security Metrics: KPIs, KRIs and KCIs
- Collecting, Analysing and Reporting Metrics
- Security Maturity Models and Program Assessment
- Control Types and Categories
- Control Design and Selection Based on Risk and Cost
- Control Testing: Design vs Operating Effectiveness
- Identity and Access Management
- Network and Endpoint Security Controls
- Application Security and the Secure SDLC
- Configuration, Change and Patch Management
- Cryptography for Security Managers
- Security Testing: Scanning, Pen Testing and Tracking Remediation
- Security Awareness Program Design
- Role-Based Security Training
- Phishing Simulations and Social Engineering Defences
- Third-Party Risk Management and Due Diligence
- Vendor Contracts, SLAs and Right to Audit
- Fourth-Party and Supply Chain Risk
- Outsourcing and Managed Security Services
- Security Stakeholder Communication
- Executive Dashboards and Board Reporting
- Continuous Improvement of the Security Program
Third-Party Risk Management and Due Diligence
Your risk, their hands
Most organisations rely on dozens or hundreds of suppliers: cloud platforms, payroll, IT support, marketing agencies. Each one that touches data or systems carries part of the organisation’s risk, and many major breaches start at a supplier. Management of external services (providers, suppliers, third parties and fourth parties) is a named CISM topic, and the organisation stays accountable for its data and customers whatever the contract says.
The third-party life cycle
- Plan and tier: what will the supplier access? The risk tier decides the effort.
- Due diligence, before signing.
- Contract: security requirements, right to audit, breach notification, exit terms.
- Onboard: least-privilege access; controlled connections.
- Monitor: reviews, reports, KRIs, incidents.
- Exit: access removed; data returned or destroyed.
Tier suppliers by risk
Tiering considers the data the supplier handles, how critical the service is and how connected the supplier is to the organisation’s systems. The cleaning contractor and the cloud payroll provider don’t need the same review.
Due diligence evidence
| Evidence | Gives you |
|---|---|
| Security questionnaire | The supplier’s own description, which needs verification |
| ISO 27001 certificate | A certified management system, for the stated scope |
| SOC 2 Type II report | Independent testing of controls over a period |
| Penetration test summary | Evidence of testing and remediation |
| Audit (on-site or remote) | Direct verification, under a right-to-audit clause |
Check that certificates and reports cover the services you actually use.
Monitoring throughout
- periodic reassessment by tier
- breach and incident notification within agreed times
- review of new SOC reports and certificates
- security ratings and threat intelligence on suppliers
- access reviews for supplier accounts
Example. A marketing agency is assessed at onboarding and passes. Two years later, a security rating service flags exposed admin interfaces at the agency. The security manager triggers a reassessment, and the agency fixes them within a week, as the contract requires.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| When to assess a supplier’s security | Before signing the contract |
| How to focus third-party effort | Tier suppliers by risk |
| Best independent assurance over a provider | A SOC 2 Type II report, checked for scope |
| Who is accountable after outsourcing? | The organisation |
| A supplier’s risk changes mid-contract | Reassess, and act under the contract |
In short
- Management of external services (providers, suppliers, third and fourth parties) is a named CISM topic; outsourcing work doesn't outsource accountability.
- Third-party risk management covers the whole life cycle: plan and tier, due diligence, contract, onboard, monitor, exit.
- Tiering by risk (data access, criticality, connectivity) scales effort so critical suppliers get the most scrutiny.
- Due diligence uses questionnaires, certifications (ISO 27001), SOC 2 reports, evidence review and sometimes audits.
- Monitoring continues throughout: periodic reviews, incident notification, performance against security requirements.
- Integrating security requirements into contracts and monitoring third parties' adherence are CISM tasks.
Exam traps
- Due diligence happens before the contract is signed, not after.
- A supplier's certificate must cover the services you actually use.
- Assessing every supplier the same way wastes effort and misses critical ones.
- The organisation stays accountable for its data and customers, whatever the contract says.
Slides
Click the slide and use the arrow keys. F toggles full screen.
The third-party life cycle
Tier suppliers by risk