Certified TPRM Warrior — Professional: the hardest free TPRM certification

• Policy, standard and procedure architecture
• Three-lines model, challenge and independence
• Risk appetite statements applied to third parties
• Committee reporting, KRIs and KPIs that survive scrutiny
• Operating model choices: centralised, federated, hybrid

• Inherent versus residual scoring models and their failure modes
• FAIR-style quantification and loss event framing
• Control effectiveness testing versus control existence
• Aggregation across a portfolio and comparability between tiers
• Bias, gaming and false precision in vendor scores

• DORA register of information, critical function mapping and exit plans
• NIS2 supply chain obligations and management accountability
• GDPR Article 28, subprocessor chains and transfer mechanisms
• OCC, Federal Reserve and FDIC third-party guidance expectations
• HIPAA business associate obligations, PCI DSS service provider duties, RBI and DPDP requirements

• Mapping critical business services to third and fourth parties
• Cloud and single-provider concentration
• Impact tolerance, severe but plausible scenarios and testing
• Substitutability, exit plans and stressed-exit assumptions
• Systemic and geopolitical exposure

• Security schedules, audit rights and right-to-assess clauses
• Incident notification windows and evidence obligations
• Subcontracting consent, flow-down and continuous monitoring rights
• Remediation governance, risk acceptance and time-bound exceptions
• Termination triggers and data return or destruction proof

• Third-party incident response and coordinated disclosure
• Continuous monitoring signals: attack surface, adverse media, financial distress, certificate expiry
• Trigger-based reassessment instead of calendar-only cycles
• Assessing AI and GenAI vendors: model provenance, training data, output risk, subprocessing
• Software supply chain, SBOM and open-source dependency risk

Q1. Three critical business services depend on the same cloud region of a single provider. Each individual vendor assessment is rated low residual risk. What is the correct conclusion?

• The portfolio risk is low because each assessment is low
• Concentration risk is unaddressed and must be assessed at portfolio levelCorrect
• The assessments should be re-scored as high
• No action is needed until the provider has an incident

Why: Per-vendor residual risk does not aggregate. Concentration is a portfolio property: the correct response is service-level mapping, impact tolerance testing and an exit or diversification plan, not inflating individual vendor scores.

Q2. A vendor's SOC 2 Type II report excludes the exact production environment that processes your data. What is the defensible response?

• Accept it, since a Type II exists
• Treat the in-scope report as evidence for the out-of-scope environment
• Treat the environment as unassessed and obtain direct evidence or accept the risk formallyCorrect
• Require ISO 27001 instead

Why: Scope is the first thing an auditor checks. Evidence only covers what is in scope, so an out-of-scope environment is unevidenced. Either obtain targeted evidence or record a time-bound, owned risk acceptance.

Q3. Under DORA, which artefact most directly supports supervisory review of ICT third-party dependencies?

• The vendor's marketing security page
• The register of information covering contractual arrangementsCorrect
• The internal audit charter
• The annual penetration test summary

Why: DORA expects a maintained register of information on all contractual arrangements for ICT services, with critical or important functions identified. It is the primary artefact supervisors request.