Third party
A fictional external organization or person that provides a product, service, platform, support function, integration, data-processing activity, or business capability.
High School IntermediateModule I14Lesson 4 of 8
I14.6 Third-Party and Supply Chain Risk
Learn how fictional organizations translate policy into measurable standards, approved baselines, repeatable procedures, useful guidelines, effective controls, defensible exceptions, and reviewable closure.
Lesson Progress
Third-Party and Supply Chain Risk
High School Intermediate • I14: Security Policies and Risk • Lesson 6 of 8
75% complete
Readiness Check
Before You Start
0/5 ready
Professional Hook
The Organization May Outsource a Service, but It Cannot Outsource Accountability
The fictional Northbridge organization has several reasonable deviations: a legacy connector cannot generate the preferred storage logs, one historical collection may be reproducible, and one emergency role may require faster activation. Other deviations are weaker: a supplier exception expired while access remained active, a policy review is overdue, and a recovery exercise lacks business validation. The goal is to make every deviation narrow, owned, evidence-based, monitored, time-bound, and removable.
Weak supplier review
Approve vague requests, allow broad scope, skip compensating controls, renew automatically, and close without proving the preferred control was restored.
Professional supplier review
Identify the exact requirement and objective, limit scope, validate controls, assign authority, set milestones and expiration, monitor risk, and prove safe closure.
Objective 1
Explain how fictional third-party and supply-chain risk connects business need, service dependency, data sharing, access, software components, contracts, controls, monitoring, incident duties, recovery, and exit planning.
Objective 2
Distinguish fictional vendors, service providers, partners, subcontractors, software dependencies, open-source components, managed services, and fourth-party relationships.
Objective 3
Build a fictional third-party risk review that documents ownership, due diligence, access boundaries, data handling, control evidence, service levels, incident communication, recovery, and offboarding.
Objective 4
Evaluate fictional supplier risk using criticality, concentration, access, data sensitivity, control evidence, dependency, resilience, contract terms, monitoring, confidence, and residual risk.
Objective 5
Create a portfolio-safe fictional supply-chain package with a supplier inventory, evidence register, findings, treatment plan, monitoring model, exit plan, and leadership summary.
Why This Matters
Documents and Exceptions Determine How Security Direction Becomes Accountable Operation
A fictional policy may say protect confidential information, but a standard must define required outcomes, a baseline must define minimum settings, a procedure must explain execution, a control must operate, evidence must prove performance, and an exception process must manage justified deviations. Without those links, documents can create confidence without actual control.
Core Concept
Use the Need–Boundary–Evidence–Exit Model
Need
Which fictional business service, users, deadline, data, recovery objective, or specialized capability requires the supplier?
Boundary
Which fictional identities, roles, systems, data, regions, fourth parties, actions, responsibilities, and contract controls define the relationship?
Evidence
Which fictional access records, control reports, service metrics, incidents, tests, source-health notes, exceptions, and changes show current performance?
Exit
Which fictional access removal, data return or deletion, integration shutdown, replacement, continuity, knowledge transfer, validation, and owner signoff end the relationship safely?
Key Vocabulary
Third-Party, Supply-Chain, and Exit Terms
Fourth party
A fictional subcontractor, dependency, platform, or service used by a third party to deliver its own service.
Supply chain
The fictional network of providers, software, services, people, infrastructure, data flows, dependencies, and handoffs required to deliver an organizational capability.
Due diligence
A fictional evidence-based review performed before or during a relationship to understand capability, controls, risk, ownership, and business fit.
Supplier criticality
A fictional judgment about how strongly a supplier affects essential services, users, data, recovery, deadlines, or organizational commitments.
Concentration risk
A fictional condition in which several important services rely on the same supplier, region, platform, technology, identity provider, or specialized person.
Data processing
Fictional collection, access, storage, transmission, transformation, analysis, retention, deletion, backup, or recovery involving organizational data.
Access boundary
The fictional identities, roles, systems, networks, data, actions, times, conditions, and environments a supplier is approved to reach.
Service-level objective
A fictional measurable target for availability, support, response, recovery, performance, or evidence delivery.
Contractual control
A fictional requirement documented in an agreement, such as incident notice, data handling, evidence rights, access limits, recovery, deletion, or subcontractor approval.
Shared responsibility
A fictional division of security, privacy, recovery, monitoring, support, and incident duties between the organization and supplier.
Supplier monitoring
Fictional ongoing review of service health, access, incidents, changes, evidence, exceptions, performance, and risk indicators.
Offboarding
A fictional controlled process for ending access, data handling, integrations, accounts, contracts, keys, connections, support, and retained copies.
Exit plan
A fictional documented method for transitioning away from a supplier while preserving service, data, evidence, recovery, and business continuity.
Software component inventory
A fictional record of libraries, packages, modules, versions, owners, sources, dependencies, licenses, and support status used in a software product.
Residual supplier risk
The fictional risk remaining after contractual, technical, administrative, monitoring, recovery, and exit controls are considered.
Supplier Relationship Types
Five Major Fictional Supplier and Component Types
Direct service providers
When it fits
Provide fictional cloud, hosting, storage, identity, monitoring, communications, backup, support, or managed operational capabilities.
Fictional example
A cloud platform hosts several critical Northbridge services and creates concentration and shared-responsibility questions.
Required evidence
Service scope, responsibility map, architecture, data flow, access, service commitments, incidents, recovery tests, and exit plan.
Important limit
A healthy service today does not remove structural concentration or exit risk.
Software and component suppliers
When it fits
Provide fictional applications, libraries, packages, frameworks, updates, integrations, or development tools.
Fictional example
An aging export library remains concentrated in a critical reporting workflow.
Required evidence
Component inventory, source, version, support status, maintainer activity, update process, tests, owner, and replacement path.
Important limit
An aging component does not prove malicious behavior or exploitation.
Partners and consultants
When it fits
Provide fictional migration, implementation, troubleshooting, training, specialist support, or shared-program access.
Fictional example
A support account remains active after the project and exception ended.
Required evidence
Statement of work, sponsor, project dates, access scope, approvals, activity, deliverables, offboarding, and knowledge transfer.
Important limit
Stale access is a control gap but does not prove misuse.
Fourth parties and subprocessors
When it fits
Support a fictional supplier through subcontracted platforms, people, data-processing services, infrastructure, or components.
Fictional example
A communications vendor uses a subprocessor for delivery analytics and retention.
Required evidence
Subprocessor list, data map, change notices, equivalent controls, incident duties, access, retention, and termination obligations.
Important limit
Direct evidence may be weaker for distant fourth parties and should remain visible in residual risk.
Open-source and community dependencies
When it fits
Provide fictional libraries, frameworks, tools, packages, and components without a traditional supplier contract.
Fictional example
A community-maintained export package requires owner review, source verification, staged updates, and a replacement option.
Required evidence
Component inventory, source, version, verification, maintainer activity, update cadence, tests, license concept, owner, and replacement plan.
Important limit
Community software can be appropriate when ownership, provenance, testing, updates, and replacement are managed.
Supplier Control Families
Eight Supplier Control Families for Fictional Treatment Plans
Business need and criticality
Purpose
Connects the fictional supplier to a documented service, user group, deadline, data set, recovery objective, and business owner.
Examples
Service criticality, user population, minimum service, recovery target, owner, and alternate process.
Evidence
Service catalog, BIA, owner approval, user dependency, deadlines, recovery objectives, and current usage.
Failure risk
The relationship continues without a current business purpose or accountable owner.
Responsibility and contract controls
Purpose
Defines fictional service, security, privacy, access, monitoring, incident, recovery, evidence, subcontractor, and exit duties.
Examples
Responsibility matrix, service scope, access clauses, notification duties, evidence rights, deletion, and transition support.
Evidence
Agreement, responsibility map, approved changes, contacts, exercises, reviews, and issue records.
Failure risk
Each party assumes the other owns an important control or incident action.
Identity and access controls
Purpose
Limits fictional supplier identities, roles, resources, actions, times, conditions, devices, locations, and sessions.
Examples
Named accounts, narrow roles, strong authentication, temporary activation, sponsor review, monitoring, expiration, and offboarding.
Evidence
Access register, approvals, role maps, sessions, reviews, denied tests, expirations, and closure records.
Failure risk
Shared, broad, or stale access remains after the approved business need ends.
Data and privacy controls
Purpose
Governs fictional data purpose, classification, collection, access, locations, sharing, retention, backups, return, and deletion.
Examples
Data map, minimization, encryption, retention, subprocessor review, deletion verification, and owner approval.
Evidence
Processing inventory, data flows, access records, locations, retention schedule, deletion records, and owner decisions.
Failure risk
The organization cannot identify every supplier copy, use, location, or deletion obligation.
Security evidence and monitoring
Purpose
Validates fictional control operation, changes, exceptions, incidents, access, service health, remediation, and risk indicators.
Examples
Scoped assurance evidence, service metrics, access logs, source-health checks, alerts, findings, and review cadence.
Evidence
Current reports, raw records, scope notes, limitations, remediation status, monitoring results, and owner review.
Failure risk
One certification or marketing statement is treated as complete proof.
Resilience and recovery controls
Purpose
Protects fictional availability, recovery, data restoration, alternate service, support, communication, and minimum business capability.
Examples
Service objectives, backups, restore tests, alternate process, recovery exercise, regional plan, and customer recovery.
Evidence
Architecture, service history, recovery plan, test results, incidents, lessons learned, and owner validation.
Failure risk
Service credits replace practical recovery planning and testing.
Incident and change controls
Purpose
Defines fictional notification, escalation, evidence preservation, investigation support, communication, remediation, and significant-change reporting.
Examples
Incident contacts, notification targets, exercises, change notices, component alerts, evidence handoff, and lessons learned.
Evidence
Clauses, contact tests, incident records, timelines, evidence packages, change history, and follow-up actions.
Failure risk
The supplier controls timing and evidence while the customer lacks defined rights and contacts.
Offboarding and exit controls
Purpose
Ends fictional access, data processing, integrations, keys, accounts, contracts, support, knowledge dependence, and retained copies safely.
Examples
Access removal, data export, deletion verification, integration shutdown, knowledge transfer, parallel service, and owner signoff.
Evidence
Exit plan, migration test, access closure, data return, deletion records, continuity validation, and closure review.
Failure risk
The contract ends while access, data, integrations, or hidden dependencies remain.
Due Diligence Criteria
Eight Questions before Approving or Renewing a Fictional Supplier
Service relevance
Strong selection
The fictional evidence directly covers the exact supplier service, region, data, access, control, and time period used by Northbridge.
Weak selection
A broad report is accepted even though the reviewed service is outside its scope.
Reviewer question
Does this evidence apply to the exact relationship being assessed?
Current control operation
Strong selection
The fictional supplier shows current implementation, operating records, tests, exceptions, remediation, and owner review.
Weak selection
A policy statement is treated as proof that the control operates.
Reviewer question
What evidence shows the control is working now?
Data and access boundary
Strong selection
The fictional review identifies exact identities, roles, systems, actions, data, locations, retention, and subprocessors.
Weak selection
The supplier is called limited without a documented boundary.
Reviewer question
What can the supplier actually access, process, retain, and share?
Independence and traceability
Strong selection
The fictional conclusion uses several traceable sources with different origins and preserves parent evidence.
Weak selection
Several screenshots from one portal are counted as independent assurance.
Reviewer question
Can another reviewer reconstruct the supplier conclusion?
Resilience and concentration
Strong selection
The fictional review maps shared providers, regions, platforms, people, components, recovery paths, and alternate service.
Weak selection
Current service health is treated as proof that concentration does not matter.
Reviewer question
Which critical capabilities share the same dependency?
Incident and change readiness
Strong selection
The fictional contacts, thresholds, notice timing, evidence handoff, significant changes, exercises, and escalation paths are tested.
Weak selection
Contract language exists but no one has tested the process.
Reviewer question
Will both parties know what to do during an incident or major change?
Offboarding feasibility
Strong selection
The fictional organization can remove access, export data, verify deletion, replace integrations, preserve evidence, transfer knowledge, and continue minimum service.
Weak selection
Exit planning begins only after termination is announced.
Reviewer question
Can the organization leave safely without losing control of service or data?
Residual risk and ownership
Strong selection
The fictional remaining risk, confidence, limitations, treatment, monitoring, risk owner, review date, and escalation triggers are documented.
Weak selection
The supplier receives a rating but no accountable decision follows.
Reviewer question
What risk remains, who owns it, and when is it reviewed?
Supplier Register
Northbridge Fictional Supplier and Component Records
NBR-TPR-01
Fictional Support Vendor
Immediate ReviewSelected controls
Confirm sponsor, remove or narrowly renew the account, preserve activity evidence, monitor, and validate offboarding.
Treatment owner
Third-Party Risk Owner
Validation
Supplier access fails after removal or matches the newly approved narrow scope; approved internal support continues.
Residual risk
Low-Medium after verified removal or renewal.
Evidence limit
No unauthorized use or disclosure is confirmed.
NBR-TPR-02
Fictional Cloud Platform
Concentration ManagementSelected controls
Maintain shared-responsibility maps, customer recovery, regional design, evidence access, service monitoring, and exit planning.
Treatment owner
Cloud Service Owner
Validation
Regional and customer recovery exercises meet approved minimum-service objectives.
Residual risk
Medium structural concentration risk.
Evidence limit
No current provider-controlled incident is supported.
NBR-TPR-03
Fictional Federation Partner
Expire or RenewSelected controls
Confirm sponsor, end stale trust and role, review sign-ins, test denied access, and document narrow renewal if required.
Treatment owner
Identity Governance
Validation
Expired partner sessions fail while approved internal and renewed partner workflows behave as expected.
Residual risk
Low after closure or narrow renewal.
Evidence limit
No post-program sign-in or resource access is confirmed.
NBR-TPR-04
Fictional Managed Monitoring Provider
Continuity ImprovementSelected controls
Preserve internal evidence access, test alternate escalation, review read-only access, validate contacts, and monitor service quality.
Treatment owner
Security Operations
Validation
Internal teams can receive evidence and escalate priority cases during a provider interruption.
Residual risk
Medium-Low after alternate-process testing.
Evidence limit
The provider does not operate every source or investigation.
NBR-TPR-05
Fictional Backup Service
Scope DecisionSelected controls
Validate reconstruction of the excluded collection or add backup coverage, then retest restore and owner approval.
Treatment owner
Recovery Owner
Validation
Required data is restored or reconstructed within the approved recovery objective.
Residual risk
Depends on the test outcome.
Evidence limit
No current backup failure or data loss is confirmed.
NBR-TPR-06
Fictional Open-Source Export Library
Staged UpgradeSelected controls
Verify source, test the supported version, preserve rollback, monitor application behavior, and maintain a replacement option.
Treatment owner
Application Product Owner
Validation
Approved exports succeed, expected tests pass, and rollback remains available.
Residual risk
Low-Medium after upgrade and replacement planning.
Evidence limit
No malicious component behavior is supported.
NBR-TPR-07
Fictional Communications Provider
Data and Continuity ReviewSelected controls
Minimize message content, confirm retention and deletion, restrict service identity, monitor delivery, and test alternate communication.
Treatment owner
Communications Service Owner
Validation
Approved notifications work, excessive content is absent, and alternate communication succeeds.
Residual risk
Low-Medium.
Evidence limit
No current misdelivery or privacy incident is confirmed.
NBR-TPR-08
Fictional Recovery Consultant
Controlled Temporary AccessSelected controls
Use scheduled narrow access, automatic expiration, activity logging, evidence review, offboarding, and knowledge transfer.
Treatment owner
Continuity Manager
Validation
Access expires after each exercise and internal teams retain required knowledge and records.
Residual risk
Low when controls operate.
Evidence limit
No stale access is currently shown.
Defensive Workflow
Review Suppliers, Dependencies, Controls, Monitoring, and Exit
Confirm the fictional supplier question
State the business need, service, criticality, users, data, access, dependencies, owners, evidence, review period, privacy limits, and required decisions.
Output: Third-party review charter.
Inventory suppliers and dependencies
Map fictional providers, services, fourth parties, software components, data flows, access paths, regions, owners, and concentration.
Output: Supplier and supply-chain register.
Map responsibility and contract controls
Assign fictional service, security, privacy, access, monitoring, incident, recovery, evidence, subcontractor, and exit duties.
Output: Responsibility and contract-control matrix.
Validate due diligence evidence
Review fictional business need, scope, data, access, control evidence, resilience, incidents, changes, ownership, limitations, and current status.
Output: Supplier evidence register.
Assess supplier risk
Evaluate fictional criticality, access, data sensitivity, concentration, control effectiveness, resilience, uncertainty, likelihood, impact, and confidence.
Output: Third-party risk register.
Select treatment and monitoring
Define fictional access reduction, contractual correction, control improvement, alternate service, monitoring, exception, recovery, and owner actions.
Output: Supplier treatment plan.
Test offboarding and exit
Validate fictional access removal, data export, deletion, dependency replacement, knowledge transfer, minimum service, communication, monitoring, and closure.
Output: Exit and offboarding test record.
Review and communicate
Confirm fictional findings, alternatives, confidence, limitations, residual risk, leadership decisions, reassessment triggers, and portfolio safety.
Output: Reviewed supplier-risk package.
Fake Dashboard
Fake Northbridge Third-Party Risk Dashboard
Training dashboard for fictional supplier and supply-chain evidence only.
Relationships reviewed
8
Cloud, support, identity, monitoring, backup, software, communications, and recovery relationships are mapped.
Priority supplier actions
4
Stale access, stale federation, concentration, component aging, and backup scope require owner decisions.
Confirmed supplier incidents
0
The supplied fictional evidence supports lifecycle and control gaps but no confirmed supplier compromise or disclosure.
Fake SOC Alert
Supplier Access Remains Active after Project and Exception End
Source: Fake Third-Party Risk Console • Time: 2:10 PM
A fictional support supplier retains one limited account after the project ended and the exception expired. Complete post-expiration activity review is not yet available.
Defensive recommendation: Confirm the exact requirement, control objective, current business need, scope, activity, compensating controls, residual risk, authority, expiration, and owner. Remove or narrowly renew the access, validate expected service behavior, monitor, and document closure without claiming misuse.
Fake Log Panel
Fake Northbridge Supplier Review Records
training-log-viewer.log
09:00 CHARTER scope='third-party and supply-chain risk' 09:08 SUPPLIER support-vendor criticality='High' 09:16 ACCESS supplier-account='active after closure' 09:24 EXCEPTION supplier='expired' 09:32 FEDERATION partner-trust='stale' 09:40 PROVIDER cloud-platform concentration='Critical' 09:48 MONITORING managed-provider alternate-escalation='untested' 09:56 BACKUP historical-collection scope='excluded' 10:04 COMPONENT export-library version='aging' 10:12 COMMUNICATION alternate-channel='documented' 10:20 CONSULTANT temporary-access='expires correctly' 10:28 FINDING confirmed-supplier-incident='not supported' 10:36 PRIORITY stale-access='first' 10:44 EXIT data-return-and-deletion='required' 10:52 ASSURANCE one-report='not complete proof' 11:00 CLOSE requires='access + data + dependency + owner'
Training note: this is fake data for defensive analysis practice only.
Findings Matrix
Northbridge Supplier-Risk Findings and Limits
NBR-TPR-F01High
The fictional Support Vendor requires immediate access review because its project and exception ended while one supplier account remains active.
Evidence support
Project closure, expired exception, account status, sponsor record, limited service scope, network restriction, and incomplete activity review.
Alternative
A current support need may justify a narrow renewed agreement and access scope.
Limitation
No unauthorized use, malicious intent, or disclosure is confirmed.
NBR-TPR-F02High
The fictional Cloud Platform creates material concentration risk because several critical services share one provider and regional control plane.
Evidence support
Architecture, service inventory, provider dependency map, regional design, recovery plan, support model, and exit analysis.
Alternative
Strong provider resilience and tested customer recovery may reduce practical risk.
Limitation
No current provider-controlled disruption is supported.
NBR-TPR-F03High
The fictional Federation Partner trust should expire unless a current sponsor approves a narrow renewed business purpose.
Evidence support
Program closure, sponsor expiration, active trust, role assignment, sign-in records, and partner-access policy.
Alternative
A follow-up program may still require limited access.
Limitation
No post-program sign-in or resource access is confirmed.
NBR-TPR-F04Medium-High
The fictional Managed Monitoring Provider is an important evidence dependency and requires tested internal access and alternate escalation.
Evidence support
After-hours service scope, alert access, escalation records, internal log ownership, source limitations, and continuity plan.
Alternative
Internal teams may already cover most urgent cases during provider disruption.
Limitation
The provider does not control every source or investigation.
NBR-TPR-F05Medium-High
The fictional open-source export library requires staged upgrade and replacement planning because the current version is aging and concentrated in a critical workflow.
Evidence support
Component inventory, version age, maintainer activity, update availability, application dependency, tests, and owner review.
Alternative
The current version may remain stable and supported enough for a short transition.
Limitation
No malicious behavior or confirmed exploitation is supported.
NBR-TPR-F06High
No fictional supplier relationship should be considered closed until access, data return or deletion, integrations, keys, evidence, support, knowledge, monitoring, and owner signoff are validated.
Evidence support
Offboarding policy, access records, data map, contract controls, exit plans, supplier incidents, knowledge transfer, and closure requirements.
Alternative
Some low-risk suppliers may require a simpler proportional closure process.
Limitation
Closure evidence should match the actual service and data scope.
Analyze the Evidence
What Does the Active Supplier Account Support?
The fictional support project ended.
The supplier exception expired.
One limited supplier account remains active.
The account can reach a narrow support service.
Complete post-expiration activity evidence is unavailable.
No unauthorized sign-in, record access, or disclosure is shown.
The authorized owner can remove or narrowly renew the access.
Which conclusion is strongest?
Common Mistakes
Mistakes That Weaken Third-Party and Supply-Chain Risk Analysis
Treating fictional third-party risk as a one-time questionnaire instead of a full lifecycle from business need through exit.
Assuming a contract, certification, or assurance report proves every control for every service, region, and time period.
Failing to map fourth parties, software components, subcontractors, and shared infrastructure.
Allowing supplier access to remain active after a project, sponsor, exception, or contract ends.
Using shared or permanent supplier administrator accounts instead of named, narrow, monitored, time-bound access.
Treating risk transfer as removal of organizational accountability.
Ignoring data locations, copies, retention, backups, deletion, and subprocessors.
Relying on service credits instead of actual business recovery capability.
Accepting incident-notification language without testing contacts, timing, evidence, and communication.
Ignoring supplier concentration because each individual service appears healthy.
Failing to preserve internal access to logs, configurations, data exports, and recovery evidence.
Treating an active supplier account, aging component, or provider dependency as proof of compromise.
Ending a contract without validating access removal, data return or deletion, integration shutdown, knowledge transfer, and minimum service.
Using or exposing any real supplier contract, company architecture, employee identity, access record, school data, credentials, incident evidence, private vendor report, or confidential business information.
Safe Practice Lab
Build the Northbridge Third-Party and Supply-Chain Risk Package
Your fictional assignment
Suppliers, Fourth Parties, Access, Data, Controls, Monitoring, and Exit
Use only the supplied fictional Northbridge records to complete an end-to-end third-party and supply-chain risk review.
Required deliverables
- Third-party review charter with business need, scope, owners, evidence, privacy, and decisions.
- Supplier, fourth-party, component, service, data, access, region, dependency, and concentration register.
- Responsibility and contract-control matrix for security, privacy, monitoring, incidents, recovery, evidence, and exit.
- Due-diligence evidence review with source health, exceptions, confidence, alternatives, and limitations.
- Supplier risk register with criticality, access, data sensitivity, likelihood, impact, controls, and owners.
- Treatment and monitoring plan with thresholds, reviews, access reduction, recovery, and contractual actions.
- Offboarding and exit test with access closure, data return or deletion, dependency replacement, continuity, and signoff.
- Technical summary, leadership summary, reflection, and portfolio-safety statement.
Complete the lab only with fictional evidence displayed on this page. Do not use real supplier contracts, access records, private reports, company architecture, employee data, school records, credentials, incidents, or confidential business information.
Scenario Decision Lab
A Supplier Certification Looks Strong, but the Reviewed Service Is Unclear
The fictional supplier provides a recent assurance report, but its scope does not clearly include the exact support service and region used by Northbridge.
Scenario Decision Lab
A Critical Cloud Provider Creates Concentration Risk
The fictional learning, identity, storage, monitoring, and recovery services rely on one cloud platform, but current provider service health is normal.
Defender Habits
Third-Party and Supply-Chain Risk Checklist
Check Your Understanding
I14.6 Mini Quiz: Third-Party and Supply Chain Risk
Choose your answers first. Explanations appear only after submission.
1. What is fictional third-party risk management?
2. What is a fictional fourth party?
3. What does an expired fictional supplier exception with active access prove?
4. Why is fictional supplier concentration risk important?
5. What makes fictional supplier evidence useful?
6. What should a fictional supplier exit plan include?
7. What makes a fictional third-party finding defensible?
Portfolio Prompt
Portfolio Prompt
Create a fictional Third-Party and Supply-Chain Risk Package for Northbridge. Include the review charter, supplier inventory, fourth-party and component map, business criticality, service and responsibility boundaries, data flows, access model, due-diligence evidence, contract controls, service and recovery objectives, incident duties, monitoring indicators, concentration analysis, supplier risk register, treatment plan, offboarding and exit test, residual risk, leadership summary, reflection, and a portfolio-safety statement.
Use only fictional suppliers, services, components, contracts, access records, data, owners, evidence, dates, incidents, and decisions.
Do not treat a certification, active account, aging component, provider dependency, or fourth-party relationship as proof of compromise.
Make every supplier conclusion traceable to the exact service, region, data, access, control, evidence, and time period.
Show how the organization can continue minimum service and preserve data and evidence during supplier disruption or exit.
Key Takeaways
What You Should Remember
1.Third-party risk management covers the complete lifecycle from business need through exit.
2.Fourth parties and software components can create hidden dependencies behind direct suppliers.
3.Contracts define expectations, but operating evidence shows whether controls actually work.
4.Risk transfer never removes all organizational accountability.
5.Supplier concentration can be important even while current service health is normal.
6.Offboarding is complete only after access, data, integrations, dependencies, evidence, knowledge, and owner signoff are validated.
7.Portfolio artifacts should use fully fictional supplier evidence and never expose real organizational records.
Navigation