<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-third-party-risk-awareness
description: >-
  Perform third-party risk awareness training covering vendor assessment,
  supply chain security, SaaS risk evaluation, contract security clauses,
  and continuous monitoring aligned with NIST CSF and ISO 27036.
domain: cybersecurity
subdomain: security-awareness
tags:
  - third-party-risk
  - vendor-management
  - supply-chain
  - saas-risk
  - tprm
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1199"]
---

# Performing Third Party Risk Awareness

## Overview

Third-party risk awareness ensures employees understand security implications
of vendor relationships. This skill covers vendor risk assessment training,
supply chain attack awareness, SaaS security evaluation criteria, contract
security requirements, and continuous monitoring of third-party risk posture.

## Prerequisites

| Requirement | Install |
|---|---|
| TPRM platform | SecurityScorecard, BitSight, or Prevalent |
| Vendor inventory | Centralized third-party vendor register |
| Standards | NIST CSF, ISO 27036, SIG Questionnaire |

## Commands

| Command | Description |
|---|---|
| `node agent.js vendor-training --audience procurement --risk-tier critical` | Generate vendor risk training for procurement teams |
| `node agent.js supply-chain --scenarios solarwinds,log4j,codecov` | Build supply chain attack awareness scenarios |
| `node agent.js saas-eval --checklist soc2,encryption,access-control` | Create SaaS security evaluation training |
| `node agent.js contract-review --clauses security,breach-notification,audit-rights` | Train on security contract clause review |

## Workflow

### Step 1 — Assess Current State

Evaluate existing capabilities and identify gaps before implementing changes.

```bash
# Run assessment with agent tooling
node agent.js vendor-training --audience procurement --risk-tier critical
```

### Step 2 — Plan and Design

Define objectives, scope, timeline, and success criteria.

```bash
# Plan implementation
node agent.js supply-chain --scenarios solarwinds,log4j,codecov
```

### Step 3 — Execute and Deliver

Implement the planned activities and deliver outputs.

```bash
# Execute delivery
node agent.js saas-eval --checklist soc2,encryption,access-control
```

### Step 4 — Measure and Optimize

Track results against success criteria and iterate.

```bash
# Measure results
node agent.js contract-review --clauses security,breach-notification,audit-rights
```

## Verification

- [ ] Prerequisites validated and tools installed
- [ ] Assessment of current state completed
- [ ] Implementation plan documented and approved
- [ ] Execution completed per plan
- [ ] Results measured against defined KPIs
- [ ] Findings documented and next steps identified
