Third-Party Cyber and Technology Risk Management

Course Overview

This program develops practical capability for organizations that depend on external technology, cloud, software and service providers. Participants learn to prioritize suppliers by criticality, strengthen due diligence, improve contract expectations and manage resilience, concentration and exit throughout the vendor lifecycle.

Private cohorts can adapt examples, governance and scenarios to the organization’s sector and operating environment while protecting confidential information.

Regional application: Relevant across Europe, GCC, Asia and Africa for organizations with material cloud, software, outsourcing and technology-provider dependencies.

What Participants Will Learn

Business Problems This Program Is Designed to Address

Course Outline

Applied Practice and Scenario Work

Participants use realistic situations to practise analysis, judgement, stakeholder communication and workplace application.

Practical Tools and Work Products

What Strong Practice Looks Like

Third-party risk should be proportional to what the supplier can affect, not only supplier size or contract value.

Contracts need evidence and cooperation rights that can actually support oversight.

Monitoring should be triggered by meaningful change, incidents and dependency shifts.

Exit planning is part of risk management for critical services, not an administrative afterthought.

Questions Participants Learn to Ask

• What can this supplier access or disrupt?
• Which evidence matters for this vendor’s risk profile?
• What change should trigger reassessment?
• Could we continue or exit if this provider failed?

Implementation Pitfalls and Cross-Functional Interfaces

• Procurement for supplier lifecycle decisions
• Cybersecurity for technical risk
• Business owners for criticality and impact
• Legal and resilience teams for contracts and contingency

Participants identify where ownership, evidence or escalation currently breaks down and which management routine should change after the program.

Advanced Application Considerations

Advanced application should differentiate third parties by the business consequences of failure, access and substitutability rather than by spend alone. Participants should connect due diligence to contract requirements, define change triggers for reassessment, examine concentration and subcontracting, and make exit planning part of risk management for critical technology dependencies.

• Supplier criticality should reflect what the provider can access, disrupt or concentrate.
• Contract expectations should include evidence and cooperation rights that can support real oversight.
• Monitoring should respond to meaningful supplier, service, ownership or threat changes.
• Exit plans should address data, access, continuity and transition before the relationship becomes stressed.

Common Failure Modes to Challenge

The course explicitly tests failure patterns that often look acceptable on paper but weaken governance in practice:

• Applying the same due-diligence process to every supplier regardless of access or criticality
• Relying on certifications without understanding the provider’s actual role in a critical service
• Failing to reassess when ownership, subcontracting, architecture or service scope changes
• Discovering concentration and exit constraints only after an incident or commercial dispute

How Participants Work During the Program

Participants work through realistic enterprise decisions, structured diagnosis, scenario analysis and practical work products. Each concept is followed by application: the cohort identifies the decision or control problem, tests assumptions and evidence, then converts the analysis into a governance action, decision brief, control design or implementation step that can be reused at work.

Private cohorts can use sanitized versions of current workflows, policies, vendor situations or governance questions. The facilitator can increase technical depth for specialist populations or keep the emphasis on management judgement for executive and cross-functional groups.

Manager Reinforcement and Evidence of Application

Sponsors can define a small set of observable outputs before delivery, such as a completed risk assessment, clearer decision rights, a stronger review pack, an approved control action or a better escalation route. Managers can reinforce application by reviewing where the tool was used and whether the resulting decision was better supported by evidence.

• Use of course tools in live work
• Clearer ownership and escalation
• Higher-quality decision or assurance records
• More consistent treatment of similar cases
• Evidence that remediation is entering normal operating routines

Designing a Private Cohort Around Real Work

A private cohort can be designed around the organization’s actual operating model, participant responsibilities and governance maturity. Useful sponsor inputs include the roles in the room, current policies or frameworks, recurring decisions, representative scenarios and the work products participants should be able to produce more consistently after the program.

The course should not be turned into a confidential audit or legal review. Real context can be used selectively to make the learning relevant while keeping organization-specific determinations with the appropriate internal or external specialists.

Sponsor Pre-Work for a Private Cohort

Useful sponsor inputs include the current vendor segmentation method, a small sample of critical technology providers, standard contract requirements and the main monitoring triggers. That context lets the cohort test whether the lifecycle process focuses attention where business consequence is highest.

Capability Maturity and Leadership Decisions

Early-stage organizations may need clear ownership, common definitions and minimum governance before sophisticated assurance adds value. More mature organizations should use the program to test exceptions, changes, cross-functional interfaces and the quality of management challenge. This keeps the content relevant to both developing and established control environments.

A useful maturity test is whether the organization can explain who owns the decision, what evidence is expected, which change triggers reassessment and how issues are escalated and closed. Where that depends on informal knowledge, the capability remains fragile.

Who Should Attend

• Third-party and technology risk professionals
• Cybersecurity and compliance teams
• Procurement and vendor managers
• Internal audit and operational resilience teams

Organizational Benefits

• Improve vendor risk prioritization
• Strengthen cyber due diligence
• Improve contract oversight rights
• Reduce hidden concentration risk
• Improve exit and incident preparedness

Delivery and Pricing

The program is live and instructor-led. It can be delivered in the classroom, live online or in-house. Duration is flexible and should reflect participant level, selected depth and organizational objectives.

Public and private pricing: current public fees are confirmed with scheduled cohorts. Private and customized programs are quoted according to cohort size, location, scope and customization. Request a proposal.

Frequently Asked Questions

Related Programs

• Third-Party and Vendor Risk Management
• Cybersecurity Governance for Boards and Senior Leaders
• Business Continuity and Crisis Management

Explore related Training Bundles and Corporate Academies.

Upcoming Dates & Venues