Roadmaps Security roadmaps Governance, risk, compliance and audit
Manage the security risk of vendors, suppliers and outsourcers: assessments, questionnaires, contract clauses, continuous monitoring and handling a supplier breach.
Estimated time: 15–26 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Study the breaches that came through suppliers: managed service providers, software vendors, outsourced support. They show how trust is abused.
You cannot manage suppliers you do not know about. Build the inventory from finance, procurement and IT, including the ones bought on a credit card.
Rate suppliers by the data they touch, the access they have and how much you depend on them. Put effort where the risk is.
Standard questionnaires such as SIG and CAIQ save everyone time. Learn to use them and, more importantly, to read the answers critically.
SOC 2 reports, ISO certificates and pen test summaries are evidence, but only if you read the scope, exceptions and dates. A certificate is not a guarantee.
Onboarding, contracting, ongoing monitoring, change and offboarding each need security steps. Offboarding, when access should end, is the most neglected.
Light checks for low-risk suppliers, full assessments and site visits for critical ones. Define what each tier gets and stick to it.
Breach notification, audit rights, subcontractor rules, data handling and termination terms belong in the contract. Work with legal on standard clauses.
Assessments produce gaps; track them to closure with the supplier and escalate through the business owner when they stall.
External ratings, breach news and attack surface data flag changes between assessments. Use them as signals to investigate, not as verdicts.
Your suppliers have suppliers, and many share the same cloud or software. Map the critical dependencies and the concentration risk.
When a supplier is breached you need to know fast what they hold, what access they have and whom to call. Build the playbook before you need it.
DORA, NIS2, banking outsourcing rules and sector regulators set specific supplier oversight duties, including registers and exit plans. Map them to your programme.
For suppliers you cannot operate without, plan how you would leave or survive their failure. Regulators now expect written exit strategies.
Platforms handle questionnaires, evidence, ratings and workflows at scale. Automate the routine and keep humans for the critical tier.
Software vendors bring supply chain risk: ask for SBOMs, secure development evidence and vulnerability handling. SaaS adds data location and access questions.
AI vendors, data brokers and managed detection providers raise new questions about data use, model risk and access. Extend assessments to cover them.
Track coverage by tier, assessment timeliness, open high findings and supplier incidents. Report concentration and critical supplier status to leadership.
Set the risk appetite for suppliers, the operating model with procurement and legal, and the tooling, and tie it to enterprise risk.
The best outcomes come from collaboration: shared assessments, improvement plans and honest conversations. Suppliers are partners, not suspects.
Leadership needs to know the critical suppliers, the concentration, the open risks and the incidents. Keep it short and decision-focused.
Most organisations run on other companies' software, services and people. Third-party risk management works out which suppliers matter, assesses their security, writes the right terms into contracts, monitors them over time, and responds when one of them is breached.
It combines questionnaires and evidence review with risk tiering, contract negotiation and relationships with procurement, legal and the business. The best programmes focus deeply on the few suppliers that could really hurt and keep the rest light.
Supplier breaches are now a leading way attackers reach organisations, and regulators such as DORA and NIS2 make supplier oversight a legal duty. Companies need people who can run a risk-based programme rather than a questionnaire factory.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact