Cybersecurity

Managing Third Party Vendor Risk

The skill establishes and operates a third‑party risk management program that follows NIST SP 800‑161 C‑SCRM standards. It inventories vendors, tiers them, administers SIG/CAIQ questionnaires, evaluates SOC 2 and ISO 27001 evidence, and embeds right‑to‑audit clauses in contracts while continuously monitoring and securely offboarding. Organizations use it to assess new vendors, launch a vendor‑risk framework, tier portfolios, review compliance reports, or draft security provisions in agreements.

Publisher / source

Cybersecurity Skills (Community)

Upstream record

mukul975/Anthropic-Cybersecurity-Skills

Version

Version 3

Published

2026-06-20

Publication review

Approved for publication

Content fingerprint

140f002e300e75f94277f8a402e252773ff39125a6dc81fc4417dde91caf361e