<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-third-party-risk-assessment
description: >-
  Perform third-party and vendor risk assessments including security questionnaire
  automation, SOC 2 report analysis, SLA monitoring, supply chain risk evaluation,
  and continuous vendor security posture monitoring with SIG/CAIQ frameworks.
domain: cybersecurity
subdomain: compliance-audit
tags:
  - third-party-risk
  - vendor-risk
  - tprm
  - supply-chain
  - sig
  - caiq
  - compliance
  - audit
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---

# Performing Third-Party Risk Assessment

## Overview

Third-Party Risk Management (TPRM) evaluates the security posture of vendors,
suppliers, and service providers. This skill automates vendor assessment using
SIG Lite/Full questionnaires, CAIQ analysis, SOC 2 report review, and continuous
monitoring of vendor security posture via external scanning and breach intelligence.

Mode: `[MODE: ARCHITECT]` — TPRM program design; `[MODE: BLUE]` — Vendor assessment.

## Prerequisites

| Requirement | Details |
|---|---|
| SecurityScorecard/BitSight API (optional — external risk rating) | Required |
| `jq` for JSON processing | Required |
| Vendor SOC 2 reports and SIG questionnaires | Required |

## Key Concepts

### TPRM Lifecycle

```
Third-Party Risk Assessment Lifecycle:
├── Phase 1: Vendor Identification & Tiering
│   ├── Tier 1 (Critical): Access to sensitive data, business-critical
│   │   └── Full assessment, annual reassessment, continuous monitoring
│   ├── Tier 2 (High): Access to internal systems, moderate data
│   │   └── Standard assessment, annual reassessment
│   ├── Tier 3 (Medium): Limited access, non-sensitive data
│   │   └── Questionnaire only, biennial reassessment
│   └── Tier 4 (Low): No data access, no system access
│       └── Self-attestation only
├── Phase 2: Due Diligence Assessment
│   ├── Security questionnaire (SIG Lite/Full or CAIQ)
│   ├── SOC 2 Type II report review
│   ├── Penetration test results review
│   ├── External security rating (SecurityScorecard/BitSight)
│   ├── Insurance coverage verification
│   └── Regulatory compliance evidence
├── Phase 3: Risk Analysis & Decision
│   ├── Risk scoring (inherent + residual)
│   ├── Gap identification and remediation requirements
│   ├── Risk acceptance or rejection
│   └── Contractual security requirements (DPA, SLA, BAA)
├── Phase 4: Ongoing Monitoring
│   ├── Continuous security rating monitoring
│   ├── Annual reassessment cycle
│   ├── Breach notification monitoring
│   ├── SLA compliance tracking
│   └── Contract renewal security review
└── Phase 5: Offboarding
    ├── Data return/destruction verification
    ├── Access revocation confirmation
    └── Final security assessment
```

### Vendor Risk Scoring

```
Vendor Risk Score Calculation:
├── Data Sensitivity (30% weight)
│   ├── PII/PHI/PCI data: High (9-10)
│   ├── Internal confidential: Medium (5-7)
│   └── Public data only: Low (1-3)
├── Access Level (25% weight)
│   ├── Admin/privileged access: High (9-10)
│   ├── Standard user access: Medium (5-7)
│   └── No system access: Low (1-3)
├── Business Criticality (20% weight)
│   ├── Business-stopping if unavailable: High (9-10)
│   ├── Degraded operations: Medium (5-7)
│   └── Minimal impact: Low (1-3)
├── Security Posture (15% weight)
│   ├── SOC 2 + pentest + mature program: Low risk (1-3)
│   ├── SOC 2 but gaps identified: Medium risk (5-7)
│   └── No SOC 2, limited controls: High risk (9-10)
└── Compliance (10% weight)
    ├── All required certifications: Low risk (1-3)
    ├── Some certifications: Medium risk (5-7)
    └── No certifications: High risk (9-10)

Overall Score: Weighted sum → Tier assignment
├── 8-10: Critical Risk — executive approval required
├── 5-7:  High Risk — enhanced monitoring
├── 3-4:  Medium Risk — standard monitoring
└── 1-2:  Low Risk — periodic review
```

### External Risk Rating Check

```bash
# SecurityScorecard API — vendor rating
curl -H "Authorization: Bearer $SSC_TOKEN" \
  "https://api.securityscorecard.io/companies/example.com" | \
  jq '{grade: .grade, score: .score, factors: [.factor_grades[] | {name, grade}]}'

# BitSight API — vendor rating
curl -H "Authorization: Basic $BITSIGHT_TOKEN" \
  "https://api.bitsighttech.com/ratings/v1/companies?domain=example.com" | \
  jq '.results[0] | {name, rating, rating_date}'

# Check for vendor in breach databases
curl "https://haveibeenpwned.com/api/v3/breaches?domain=example.com" \
  -H "hibp-api-key: $HIBP_KEY"
```

## Workflow

### Step 1: Tier Vendor and Initiate Assessment

```bash
node scripts/agent.js --action tier --vendor-name "Example Corp" \
  --data-sensitivity high --access-level admin \
  --output /tmp/vendor-tier.json
```

### Step 2: Analyze Vendor Security Evidence

```bash
node scripts/agent.js --action assess --vendor-name "Example Corp" \
  --soc2-report /path/to/soc2.pdf --domain example.com \
  --output /tmp/vendor-assessment.json
```

### Step 3: Generate Risk Report

```bash
node scripts/agent.js --action report --input /tmp/vendor-assessment.json \
  --output /tmp/vendor-risk-report.json
```

## Verification

- [ ] Vendor inventory complete with tier assignments
- [ ] Tier 1 vendors have SOC 2 Type II reports reviewed
- [ ] Security questionnaire responses analyzed and scored
- [ ] External security rating obtained for Tier 1-2 vendors
- [ ] Risk scores calculated with weighted factors
- [ ] Contractual security requirements documented (DPA/SLA/BAA)
- [ ] Continuous monitoring active for critical vendors
- [ ] Annual reassessment cycle scheduled

## References

- [Shared Assessments SIG](https://sharedassessments.org/)
- [CSA CAIQ](https://cloudsecurityalliance.org/star/registry/)
- [NIST SP 800-161 — Supply Chain Risk](https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final)
