Third Party Cyber Risk Management Training Course

Duration 5 days 10 modules · 33 contact hours
Level Intermediate Certificate on completion
Who attends Procurement Managers, Category Managers and others
Fee from USD 1,100 KSh 95,000 for Kenyan organisations
Where 52 cities + online See dates by city
Next start 7 Nov 2026 Course code SD-CS-111

Before you join: Participants should have basic familiarity with procurement, supplier management, cyber security, operational risk, privacy or compliance work.

Dates & prices

Two start dates a month in every city, and live online on weekdays or weekends. Fees are per participant; classroom fees include tuition, materials, lunch and refreshments, and the certificate.

Suggest a date or city

Showing the next six months. Later dates, other cities and private deliveries for your team are available on request.

Course overview

Third parties can introduce material cyber exposure through cloud platforms, payment processors, outsourced operations, software vendors, managed service providers and their subcontractors. Procurement teams must obtain timely assurance without delaying critical sourcing decisions, while security, privacy, legal and business owners need a consistent basis for accepting, treating or rejecting supplier risk. Weak supplier inventories, generic questionnaires, unclear approvals and poorly drafted security clauses can leave material gaps undiscovered until an incident, audit or contract dispute.

This course teaches participants to run a disciplined third-party cyber risk process from initial sourcing through onboarding, ongoing monitoring, incident response and exit. Participants learn to tier suppliers by criticality and inherent risk; scope proportionate due diligence; assess evidence such as SOC 2 reports, ISO certificates and penetration-test results; record control gaps; calculate residual risk; and route exceptions for accountable approval. The course also covers contract schedules, audit rights, subcontractor controls, remediation commitments, continuous monitoring and governance reporting.

Teaching combines focused instructor briefings with procurement and supplier-risk cases, evidence-review tasks, group decision exercises, incident simulations and structured application planning. Cases reflect situations faced by banks, public bodies, multinationals, NGOs and technology-dependent service organisations. Participants leave with a reusable third-party cyber risk management pack containing a supplier-tiering model, due-diligence plan, evidence-review checklist, risk register, contract control schedule and 90-day implementation plan. Successful participants receive a certificate of completion.

The course is particularly suited to procurement and vendor-management professionals who need to work credibly with cyber security, privacy, legal and business stakeholders. It also serves security and risk specialists responsible for setting supplier assurance requirements and reporting material exposures to governance forums.

What you will be able to do

  • Design a tiered third-party cyber risk process using inherent and residual risk criteria
  • Classify suppliers using service criticality, data flows, access rights and concentration factors
  • Scope proportionate due diligence using NIST SP 800-161r1, ISO 27001 and SIG methods
  • Assess supplier security evidence including SOC 2 reports, certifications and test results
  • Produce risk registers, treatment plans and exception requests for accountable approval
  • Draft security contract requirements covering audit rights, incident notification and subcontractors
  • Establish continuous monitoring, reassessment triggers and management risk reporting
  • Create a 90-day plan for improving a third-party cyber risk management programme

Benefits of attending

For you

  • Make defensible supplier cyber risk decisions during sourcing and contract renewal
  • Interpret SOC 2 reports, ISO certificates and remediation evidence with greater confidence
  • Write focused due-diligence questions instead of issuing generic security questionnaires
  • Escalate material supplier risks with clear residual-risk and ownership records
  • Build credibility with security, legal, privacy and business stakeholders

For your organisation

  • Reduce unmanaged cyber exposure from critical suppliers and subcontractors
  • Shorten assessment cycles through risk-based tiering and evidence reuse
  • Improve contract protection through defined security, audit and notification clauses
  • Provide auditable records for supplier risk acceptance, remediation and monitoring
  • Strengthen incident readiness where supplier services support critical operations

Course modules

10 modules over 5 days

Participants can define ownership, handoffs and governance across the third-party cyber risk lifecycle.

  • Third-party lifecycle mapped from business need through termination and evidence retention
  • Procurement, security, privacy and legal accountabilities assigned through a RACI matrix
  • Risk appetite statements translated into vendor acceptance and escalation criteria
  • Three-lines model separates ownership, oversight, assurance and internal audit duties
  • Stakeholder handoffs documented between sourcing, onboarding, monitoring, incident response and exit
  • Central vendor inventory fields aligned with procurement and security records

Participants can classify suppliers and assign proportionate assurance requirements using risk-based tiers.

  • Service criticality assessed using business impact analysis, recovery objectives and dependencies
  • Inherent risk scored across data, access, resilience, location and substitutability
  • Vendor tiers defined with differentiated diligence, approval and monitoring requirements
  • Data-flow diagrams identify personal data, regulated records and sensitive assets
  • Concentration risk measured for shared providers, regions and single points of failure
  • Fourth-party dependencies traced through subcontractor disclosures, attestations and service architecture
  • Risk register records owner, treatment, residual rating and review date

Participants can select and tailor supplier assurance methods to the service and risk profile.

  • NIST SP 800-161r1 practices mapped to supplier risk-management activities
  • ISO 27001 control evidence interpreted for supplier assurance decisions
  • SIG questionnaires tailored by service tier, data classification and threat exposure
  • Shared responsibility matrices distinguish customer, supplier and subcontractor security obligations
  • Control objectives converted into testable due-diligence questions and evidence requests
  • Questionnaire scope reduced by reusing current audits, certifications and reports
  • Evidence validity tested for scope, date, exceptions and issuing authority

Participants can evaluate supplier assurance evidence and document material control gaps.

  • Document reviews assess SOC 2 reports, ISO certificates and penetration tests
  • Bridge letters and management responses tested against report end dates
  • Sampling verifies asset inventory, privileged access and vulnerability management evidence
  • Control gaps recorded with impact, root cause, compensating control and owner
  • Open-source intelligence checks breach history, sanctions, ownership and adverse media
  • Onsite assessment agendas target high-risk controls, facilities and operational interviews
  • Due-diligence findings calibrated using likelihood, impact and control maturity

Participants can evaluate residual supplier risk and prepare treatment or acceptance decisions.

  • Residual risk calculated after control effectiveness and remediation commitments are assessed
  • Risk heat maps distinguished from decision-ready risk scenarios and narratives
  • FAIR analysis estimates loss event frequency and probable loss magnitude
  • Treatment options compare remediation, transfer, acceptance, avoidance and substitution
  • Exception requests document rationale, expiry, compensating controls and accountable approver
  • Approval thresholds route material supplier risks to appropriate governance forums
  • Risk acceptance registers track commitments, overdue actions and renewal triggers

Participants can specify contractual controls that support supplier cyber risk treatment and accountability.

  • Security schedules specify minimum controls, evidence and audit rights
  • Data processing clauses allocate controller, processor and breach-notification obligations
  • Contractual SLAs define availability, recovery, support and incident communication targets
  • Right-to-audit provisions address scope, notice, cost and remediation access
  • Subprocessor controls require approval, disclosure, flow-down terms and accountability
  • Cyber insurance, liability caps and indemnities reviewed with legal counsel
  • Remediation plans convert findings into dated, measurable contractual commitments

Participants can establish monitoring controls and report supplier cyber risk to decision-makers.

  • Onboarding gates prevent production access before required approvals and evidence
  • Continuous monitoring signals include breach alerts, rating changes and certificate expiry
  • Security ratings evaluated for coverage limits, false positives and validation needs
  • Periodic reassessments triggered by service changes, incidents and risk-tier requirements
  • KPIs track assessment cycle time, overdue findings and exception ageing
  • Key risk indicators report exposure, concentration, control failures and unresolved remediation
  • Management dashboards separate operational actions from board-level risk reporting

Participants can coordinate supplier cyber incident response, notification and corrective-action requirements.

  • Supplier incident playbooks define notification paths, roles, evidence and decision authority
  • Tabletop scenarios test ransomware, data exposure and cloud-service disruption responses
  • Contractual notification windows reconciled with regulatory reporting and customer commitments
  • Forensic preservation requirements address logs, chain of custody and access
  • Joint communications protocols control facts, audiences, approvals and escalation timing
  • Post-incident reviews capture root causes, corrective actions and vendor accountability
  • Business continuity dependencies tested against supplier recovery plans and failover arrangements

Participants can manage cyber risks when supplier services change, terminate or fail.

  • Exit strategies identify data return, deletion, access revocation and service continuity
  • Termination checklists assign owners, evidence and deadlines for each closure activity
  • Data destruction certificates validated against retention schedules and backup constraints
  • Transition plans address knowledge transfer, replacement sourcing and cutover risks
  • Escrow arrangements assessed for critical software, source code and release conditions
  • Supplier insolvency scenarios test contingency funding, access rights and continuity
  • Fourth-party exit impacts analysed where shared services support multiple vendors

Participants can define an improvement plan for a measurable third-party cyber risk programme.

  • Third-party risk policies define scope, roles, thresholds and minimum evidence
  • Operating procedures connect procurement workflows with security risk decisions
  • Control libraries map requirements to questionnaires, contracts, monitoring and reporting
  • Metrics pack presents tier populations, risk trends, remediation and exceptions
  • Internal audit testing prepares traceable evidence of policy adherence
  • 90-day application plan prioritises process changes, owners and success measures
  • Programme maturity assessed against defined, repeatable, measured and optimised practices

Exercises and examples are adapted to each cohort's sectors and roles.

What you take back to work

  1. Supplier cyber risk tiering model
  2. Risk-based due-diligence plan template
  3. Supplier evidence-review checklist
  4. Third-party cyber risk register
  5. Contract security control schedule
  6. 90-day programme improvement plan

Who should attend

  • Procurement Managers — need to embed proportionate cyber checks into sourcing and renewal decisions
  • Category Managers — need to assess technology and outsourced-service suppliers before contract award
  • Vendor Management Professionals — need consistent supplier oversight, remediation tracking and renewal controls
  • Third-Party Risk Managers — need practical methods for tiering, assessment and governance reporting
  • Cyber Security Managers — need to set supplier assurance requirements and evaluate control evidence
  • Privacy, Legal and Compliance Professionals — need to align contractual obligations with supplier cyber risks

Skills and tools covered

Supplier risk tieringCyber due diligenceEvidence assessmentContract security controlsResidual risk decisionsVendor risk reporting

Tools and standards

NIST SP 800-161r1, ISO/IEC 27001, Shared Assessments SIG, FAIR

How the course runs

Training methodology

The course uses short instructor briefings to introduce methods, standards and decision criteria, followed by cases based on supplier sourcing, cloud services, outsourced operations and incident scenarios. Participants review realistic assurance evidence, compare supplier-risk decisions in groups and use structured templates to record findings, treatments and approvals. Simulations test escalation, contractual notification and joint incident response. Facilitated discussions connect each method to participants' own supplier portfolios, ending with a practical application plan.

Requirements and prerequisites

Participants should have basic familiarity with procurement, supplier management, cyber security, operational risk, privacy or compliance work. Experience of sourcing, contract management, vendor onboarding, security questionnaires or risk registers is helpful. Participants should understand common business terms such as supplier, contract, control, incident and risk owner. Prior knowledge of ISO standards, SOC reports, audit methods, cloud architecture, penetration testing or quantitative risk analysis is not required. The course explains these materials in the context of supplier assurance decisions.

A typical training day

08:30 – 10:30First session
10:30 – 10:45Refreshment break
10:45 – 12:30Second session
12:30 – 13:30Lunch and networking
13:30 – 15:00Third session
15:00 – 15:15Refreshment break
15:15 – 16:30Workshop and daily review

Live online deliveries follow the same structure in East Africa Time, with shorter screen blocks and longer breaks.

What the fee includes

  • Instruction by a practitioner facilitator
  • Full course workbook and materials
  • Exercise files, templates and case studies
  • Refreshments and lunch on classroom deliveries
  • Certificate of completion
  • Post-course application plan

Frequently asked questions

Participants need basic familiarity with procurement, supplier management, cyber security, risk, privacy or compliance work. Prior experience with ISO standards, SOC reports, audits or technical testing is helpful but not required.

Bring a laptop if possible, along with an example of a supplier questionnaire, contract schedule, risk register or approval process used at work. Sensitive information should be removed or anonymised before use.

It is designed primarily for procurement, category management, vendor management and third-party risk professionals. Cyber security, privacy, legal, compliance and operational risk staff also benefit where they review or approve supplier controls.

General cyber courses focus on internal security controls, while general procurement courses focus on sourcing and commercial outcomes. This course concentrates on the controls, evidence, decisions and contract requirements needed to manage supplier cyber risk.

Participants can use the supplied templates to tier suppliers, target due diligence, assess assurance evidence and document remediation or acceptance decisions. The final application plan identifies priority changes for their own process during the next 90 days.

Each day runs from 08:30 to 16:30 and provides about 6.5 contact hours. The five days progress through ten connected modules, using briefings, evidence reviews, group work, simulations and application planning.

Questions about this course?

Ask about dates, fees, group bookings or running it for your team. Our training team replies by email.

Ask on WhatsApp info@skillsetdevelopment.com

Related courses in Cyber Security