<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Performing Third Party Risk Awareness

## Agent Script

### Commands

| Command | Description |
|---|---|
| `node agent.js vendor-training --audience procurement --risk-tier critical` | Generate vendor risk training for procurement teams |
| `node agent.js supply-chain --scenarios solarwinds,log4j,codecov` | Build supply chain attack awareness scenarios |
| `node agent.js saas-eval --checklist soc2,encryption,access-control` | Create SaaS security evaluation training |
| `node agent.js contract-review --clauses security,breach-notification,audit-rights` | Train on security contract clause review |

### Examples

```bash
# Generate vendor risk training for procurement teams
node agent.js vendor-training --audience procurement --risk-tier critical

# Build supply chain attack awareness scenarios
node agent.js supply-chain --scenarios solarwinds,log4j,codecov

# Create SaaS security evaluation training
node agent.js saas-eval --checklist soc2,encryption,access-control

# Train on security contract clause review
node agent.js contract-review --clauses security,breach-notification,audit-rights
```

## External Tools

| Tool | Command | Purpose |
|---|---|---|
| SecurityScorecard | `ssc --vendor-report --domain vendor.com` | Third-party risk rating |
| BitSight | `bitsight --portfolio-risk --tier critical` | Vendor security performance |
| Prevalent | `prevalent --assessment-status --vendor-tier 1` | TPRM workflow platform |

## Compliance Frameworks

| Standard | Training Requirement |
|---|---|
| NIST CSF ID.SC | Supply chain risk management category |
| ISO 27036 | Information security for supplier relationships |
| SIG Questionnaire | Standardized information gathering for vendors |
| NIST SP 800-161 | Supply chain risk management practices |
