TPRM Practitioner Lab - Ridgeline Care Rapid Onboarding
The Vendor Onboarding Lab is a free, hands-on third-party risk simulation in which you onboard a clinical AI documentation vendor in three weeks against a fixed clinical go-live date, and finish with a verified certification of completion.
Sign in to open the lab
TPRM Labs are free for every registered learner. Create an account or sign in to run the Ridgeline Care onboarding assessment and earn your Lab Certification.
What this TPRM lab is
The Vendor Onboarding Lab is a free, hands-on third-party risk simulation in which you onboard a clinical AI documentation vendor in three weeks against a fixed clinical go-live date, and finish with a verified certification of completion.
This is the assessment every analyst actually gets: the business has already picked the vendor, the date is already announced, the intake form arrived late, and the vendor's security contact answers one email in three. Textbook due diligence assumes cooperation and time. This lab removes both and asks the only question that matters in practice - how do you stay defensible when you cannot be exhaustive?
You act as the TPRM analyst at an eleven-site healthcare group. The platform will listen to live patient consultations, draft clinical notes and write them back into the electronic health record for around 240,000 patients. You scope the intake, tier the vendor before evidence arrives, separate independent assurance from vendor assertion, write findings rather than concerns, design compensating controls you operate yourself, and close with a conditional approval that names its conditions and dates.
Seven stages, ten decisions in each, seventy decisions in total. It takes roughly 45 to 60 minutes, runs entirely in the browser, and is free for every registered learner. Cards and assessment areas reshuffle on every load, so there is no pattern to memorise.
- Level
- Intermediate
- Time to complete
- 45 to 60 minutes
- Cost
- Free, account required
What you will practise, stage by stage
Each stage trains one specific piece of onboarding judgement that separates an analyst who can be trusted with a deadline from one who cannot.
Stage 1 - Intake triage and scoping under time pressure
You build an intake record that is right first time: business driver, data and processing profile, commercial and processing relationship, and integration and access footprint held apart. Vague intake is the root cause of most late-stage onboarding failures.
Stage 2 - Inherent risk tiering before evidence arrives
You tier on data sensitivity, business criticality, regulatory exposure and access model, not on how good the vendor's controls look. You practise a rating you can defend line by line under challenge.
Stage 3 - Due diligence with an unresponsive vendor
You separate independent assurance from vendor self-assertion, decide which gaps are material enough to chase in the time you have, and stop asking for material that proves nothing about this service.
Stage 4 - Findings, not concerns
You distinguish a control gap from an evidence gap, recognise a disclosed design choice that is not a failure, and refuse to write another vendor's problem into your findings.
Stage 5 - Remediation against a fixed go-live date
You decide what must be evidenced before the first consultation, what you cover with your own compensating controls, what is tracked after launch with a date, and what has to be escalated for formal risk acceptance.
Stage 6 - Residual risk and what the business accepts
You state what remediation genuinely reduced, what exposure remains, what needs a named owner's signature, and what was transferred by insurance or indemnity rather than reduced.
Stage 7 - Approval, contract safeguards and oversight
You close the file: the decision and its conditions, the clauses that must exist to be enforceable, the scheduled oversight, and the trigger events that reopen the review early.
Skills and deliverables you walk away with
By the end you have produced the artefacts a real onboarding file contains, and you can talk through each one in an interview.
A complete intake and scoping record
Driver, data profile, commercial record and access footprint separated cleanly enough for every later stage to rely on.
A defensible inherent risk tier
Sensitivity, criticality, regulatory exposure and access model stated as independent drivers of the rating.
A prioritised evidence plan
Independent assurance separated from assertion, with a short list of gaps genuinely worth chasing in three weeks.
Written findings
Control gaps, evidence gaps, accepted design choices and out-of-scope items correctly distinguished.
A phased remediation plan
Go-live conditions, compensating controls you operate, dated post-launch items and an escalation for what cannot be negotiated.
A residual risk statement
What reduced, what remains, what is formally accepted and by whom, and what was transferred.
An approval and oversight package
Conditions, contractual safeguards, review cadence and reassessment triggers.
Who should run this lab
This lab is for anyone who has to deliver a defensible vendor review when the date is fixed and the vendor is slow.
TPRM and vendor risk analysts: You run onboarding assessments and want to practise the pressure case safely.
Beginner Lab graduates: You know the lifecycle and now want the version where time and cooperation are both short.
GRC and information security professionals: You assess controls and want the onboarding decision framework wrapped around them.
Procurement and sourcing teams: You own the date and the contract, and want to understand what risk is asking for and why it matters.
Healthcare, AI and privacy practitioners: The scenario covers special category data, AI-assisted drafting and a write path into a clinical system.
How the lab is scored
There is no timer and no partial pass: the lab completes only when all seventy decisions sit in the correct assessment area, and you can retry as often as you like.
A wrong placement is rejected immediately with a short coaching prompt that sharpens your reasoning without handing you the answer. Correct placements lock in and open the next stage. Several facts plausibly fit two areas, so precision matters: an evidence gap is not a control gap, and a compensating control is not a vendor commitment.
Cards and assessment areas reshuffle on every attempt and every reload, so completion reflects judgement rather than recall.
In the end you get a verified certification of completion
Complete all seven stages and LearnTPRM issues you a verifiable TPRM Practitioner Lab Certification of completion, free of charge, with a unique certificate ID any employer can check on the public verification page.
There is no fee, no exam booking and no upsell. The credential is issued by LearnTPRM.com the moment the lab is completed inside your account.
Each certificate carries your full name, the lab title, the level, the award date and a unique certificate ID. Anyone - a recruiter, a hiring manager, an audit lead - can paste that ID into the public verification page and see whether the credential is genuine. You can download the certificate as a high-resolution PDF or PNG from your dashboard at any time and attach it to a CV or a LinkedIn profile.
Frequently asked questions
What does this vendor onboarding lab actually cover?
The full onboarding path for a new vendor: intake and scoping, inherent risk tiering, due diligence evidence evaluation, findings, remediation with compensating controls, residual risk and conditional approval with contractual safeguards and monitoring.
Is this lab free, and do I need to install anything?
It is free for every registered learner and runs entirely in the browser. There is nothing to install and no payment step at any point.
How long does it take?
Around 45 to 60 minutes. There is no time limit, and progress is kept for your session so you can pause and resume.
Do I need to complete the Beginner Lab first?
It is not required. If you have never run a full vendor assessment, the Beginner Lab makes the vocabulary familiar first, but this lab stands on its own.
What is a compensating control, and why does the lab focus on it?
A compensating control is a mitigation you operate yourself while a vendor gap stays open - a shorter session lock policy, a restricted deployment scope, extra sampling. The lab focuses on it because compensating controls are how real onboarding proceeds safely against a fixed date.
What outcome is considered correct?
Conditional approval with a restricted first phase, named go-live conditions, dated tracked items and a formal acceptance for what cannot be negotiated. A clean approval and an outright refusal are both wrong here.
Is the certification verifiable by an employer?
Yes. Each certificate carries a unique ID that anyone can check on the public LearnTPRM verification page, and you can download it as a PDF or PNG at any time.
Does it cover AI vendor risk?
Yes. The vendor uses AI-assisted clinical drafting, so AI governance scope, model-training use of customer data and human-in-the-loop safeguards all feature in the decisions.
Can my team use this for training?
Yes. Every learner runs it free and earns their own verifiable certification, which makes team training straightforward to evidence.
Will this help me get a TPRM job?
It gives you a documented, verifiable piece of practical work to talk through in an interview: how you tiered the vendor, what you chased, what you accepted and what conditions you attached to approval.
Related TPRM learning
- TPRM Beginner LabRun a full vendor risk assessment on a cloud payroll provider, intake to approval.
- TPRM Monitoring LabTriage a live monitoring queue across a 412-vendor portfolio.
- All TPRM LabsThe full scenario-based lab library and what each one trains.
- TPRM Templates and ChecklistsFree due diligence checklists, questionnaires and assessment templates.
- TPRM Warrior Beginner CertificationThe free beginner certification exam that pairs with this lab.
Founding SponsorAutonomous TPRM. 90% less manual effort.
Now see the same case run by AI agents
The lab put you inside a real vendor file: intake, inherent risk, diligence, findings, remediation, residual risk, approval. Every judgement you made is a step the SAFE TPRM AI Co-Worker executes autonomously - which is why practitioners who finish these labs tend to bring it to their employer.
This is for you if you own a third-party risk program - roughly 100+ vendors, quarterly reassessments, DORA / NIS2 / OCC pressure and no new headcount coming. The link opens Safe Security's platform page, not a gated form.
Trusted by 10% of the Fortune 500, and named a Leader in Liminal's TPRM Link Index.
- Intake and inherent risk scored instantly, with scope and relationship context mapped for you.
- Findings become context-rich remediation tasks with evidence, business impact and clear guidance.
- The Risk Validation agent confirms risk actually dropped before closure.
For security and risk leaders assessing a TPRM platform. Opens safe.security in a new tab.
25+
AI agents
90%
Less manual effort
None
Additional headcount
200+
Organizations globally
End to end
Intake to offboarding