Growing and mid-market organizations with dozens to a few hundred vendors
Companies whose SOC 2, ISO 27001, HITRUST or PCI DSS requirement for vendor management is open on the gap register
Cyber Risk & Resilience · THIRD-PARTY RISK MANAGEMENT
Build Your Vendor Risk Program in 4 Weeks.
An auditor needs your vendor risk program. Give them a clear record of which suppliers matter, what you checked and who accepted the risk.
We help you build a vendor inventory, risk tiers, due-diligence requirements and a consistent review method in 4–6 weeks. We apply that method to your selected vendors and deliver a decision record your team can explain to auditors, customers and management.
The method and templates stay with your team, giving you a consistent foundation for future vendor reviews.
Free 30-minute third-party risk strategy call. No obligation.
Our commitment: a clear vendor risk program your team can use, backed by 30 days of follow-up access.
Discuss your vendor risk requirements and deadline with Temi, and get a clear plan for building your program.
01
100+ — Assessments Completed
20+ — Years of Experience
4 Weeks — Vendor Risk Program Delivery
30 Days — Follow-Up Access
02
EXPERIENCE BEHIND THE ADVICE
Every third-party risk management engagement is led by Temi, with over two decades of experience across technology, financial services, healthcare and media, including consulting engagements with several Fortune 100 companies, including Amazon, Walgreens and Humana. Temi has led over 100 assessments.
- CISA
- CISM
- CRISC
- CDPSE
- PCI-QSA
LinkedIn recommendations
Recommendations for Temi
Temi is an incredibly thorough GRC professional with an impressive command of PCI requirements. During our time working together, I was consistently impressed by her ability to navigate complex audit workflows and provide clear, actionable insights. She is a dedicated expert who brings high standards of professionalism to every project.
I’ve had the privilege of working alongside Temi, and I can confidently say she is one of the most reliable and technically proficient GRC and IT Security professionals I have partnered with. Her expertise spans SOX compliance, IT risk management, security controls, and governance frameworks, and she consistently brings clarity, structure, and rigor to every engagement.
Temi has a rare ability to translate complex regulatory requirements into practical, actionable controls that strengthen organizational resilience. Her attention to detail, strong analytical mindset, and commitment to high-quality execution make her an invaluable asset to any team. Beyond her technical strengths, she is collaborative, solutions-oriented, and trusted by stakeholders across the business.
Temi is GRC professional who has exhibited top level IT security risk and audit competence by leading high visibility, high impact projects building frameworks and implementation of systems that have improved the safety and reliability of business operations in global organizations. I have interacted with Temi on tangential projects and I can attest to her professionalism, commitment and leadership.
I had the privilege of being mentored by Temi during my transition from a general tech role into the security field, and I can confidently say her guidance made a significant difference in my journey.
Temi has a rare ability to support and uplift others in whatever capacity she can. She helped me not only understand complex security concepts and frameworks, but also gain practical, real-world exposure to the role. She taught me how to think like a security professional - from communicating security concepts to cross-functional teams with varying levels of understanding, to reviewing and analyzing security documentation for accuracy and completeness.
What stood out most was her genuine investment in my growth. Whether it was recommending resources, connecting me with a trainer to deepen my knowledge, reviewing my learning path, or sharing valuable industry insights, she was always generous with her time and expertise.
If you’re looking for a mentor or security leader who truly empowers others, I highly recommend Temi. I’m incredibly grateful for her support and the lasting impact she has had on my career.
Recommendations as published on LinkedIn, shown with the recommender's name and headline at the time of writing.
03
The Three Reasons Companies Come to Us for Third-Party Risk
An auditor or customer asked for your vendor risk program. Customer and assurance requirements drive supplier oversight; PCI DSS includes scoped service-provider obligations, while HIPAA requires applicable business-associate agreements. The program document, the register and the review method answer the question in the form the assessor expects.
Vendor SOC reports arrive and you want them read consistently. A SOC report answers a specific question about a specific period and scope. One method for reading the opinion, the exceptions, the subservice organizations and the complementary user entity controls turns a stack of PDFs into decisions.
Different teams onboard vendors differently. The same vendor is approved in one team and flagged in another. Tiering, a due-diligence standard and one acceptance authority give every team the same path and every critical supplier the same scrutiny.
04
What Is Third-Party Risk Management
A program that decides, consistently and on record, which vendors matter, what to ask them, and who holds risk-acceptance authority.
Third-party risk management is the set of processes by which an organization identifies the vendors and service providers it depends on, assesses the risk each one carries to its data and operations, decides what assurance to require, and keeps that assurance current. The program maps the supplier expectations in your selected frameworks and customer contracts. NIST CSF 2.0 includes supply-chain governance outcomes. PCI DSS covers relevant third-party service providers; HIPAA business-associate obligations depend on the relationship and protected health information involved.
A working program has five parts: an inventory of vendors tiered by the data they touch, the services they provide and how hard they are to replace; a due-diligence standard that sets questionnaire, evidence and contract requirements by tier; a method for reading vendor SOC reports and other assurance; a scoring model with named acceptance authority and a remediation workflow; and a management view of which vendors matter and what is open. We design all five with you, pilot them on your highest-tier vendors, and hand the program to your team with the templates and cadence to run it.
05
The Five Parts of a Vendor Risk Program
| Part | What it contains | What it decides |
|---|---|---|
| Vendor inventory and tiering | Tier definitions, scored vendor list, critical-vendor shortlist | Where to spend assessment effort |
| Due-diligence standard by tier | Questionnaires, evidence lists and contract clauses per tier | What to ask each vendor, and what to accept |
| SOC report review framework | Checklist and template for report type and period, opinion, exceptions, subservice organizations and complementary user entity controls | Whether a vendor’s report actually covers your risk |
| Risk scoring and remediation workflow | Scoring model, acceptance authority, tracking register | Who may accept which risk, and how open items close |
| Management summary and operating cadence | Program document, annual calendar, reporting template | How the program runs after the engagement |
Apply the method through the vendor lifecycle
| Stage | Required decision and evidence |
|---|---|
| Before contract | Record the service, data/access, business owner, inherent tier and required diligence. |
| Acceptance | Record evidence limitations, residual risk, acceptance authority and any contract conditions. |
| Operation | Review assurance on the agreed risk-based schedule and after material changes; track issues with owners. |
| Supplier incident | Use the agreed notification/escalation path and assess affected services, data and continuity. |
| Exit | Revoke access and integrations, address data return/deletion and retain closure evidence. |
06
What a Vendor SOC Report Review Covers
A SOC report is evidence about one scope, one period and one set of controls. The review confirms it answers your question.
| Element | What the review checks |
|---|---|
| Report type and period | SOC 1 or SOC 2; Type 1 as of a date or Type 2 over a period; the service and controls covered |
| Opinion | The auditor’s opinion and the basis for any qualification |
| Exceptions | Deviations noted in testing, their relevance to your use of the vendor, and management’s response |
| Subservice organizations | Which providers the vendor carved out of scope, and whether you hold assurance over them |
| Complementary user entity controls | Complementary controls identified for user entities; who in your organization implements the applicable controls |
| Bridge letter | Management’s representation about changes after the report period; request current assurance where needed |
07
Evidence for the Vendor Decision
The evidence request follows the vendor's risk tier and the service you use. A document is useful when it covers that service, is current enough for the decision and has an owner who can answer gaps. The review records those limits alongside the risk score.
| Evidence area | What the vendor review records | How it supports your decision |
|---|---|---|
| Service and dependencies | Service description, relevant data flows, access, hosting arrangements and material subcontractors | Whether the evidence covers the service and dependencies your business relies on |
| Security assurance | Relevant policies, assurance reports and available summaries of control testing | What has been assessed, by whom and for what period, with unverified areas marked |
| Data handling | The data involved, stated handling arrangements and evidence relevant to agreed privacy and contract requirements | Which questions require clarification before acceptance or renewal |
| Incidents and continuity | Available incident disclosures, response responsibilities, notification arrangements and continuity evidence | Whether incident and disruption concerns have a named owner and follow-up |
| Program ownership | Responsible contacts, review dates, open corrective actions and supporting records | Whether the supplier can explain how unresolved issues will be managed |
| Assurance gaps | Missing documents, conflicting answers, scope exclusions and expired evidence | What remains unknown and who may accept that uncertainty |
We document the evidence behind each vendor risk conclusion, clearly distinguishing supplier statements from independent assurance. Your team can see what has been verified, identify gaps and decide where further evidence or testing is needed.
Connect Supplier Access and Software Dependencies to the Review
Where the agreed vendor review requires technical detail, involve the people responsible for the relevant systems. Record the evidence available, its limitations and the person responsible for resolving each question.
| Evidence question | What the decision record needs |
|---|---|
| What access does the supplier hold? | The systems and data involved, access owner, approval and removal arrangements. |
| How is supplier access authenticated? | Relevant authentication arrangements and the evidence available to review them. |
| How are supplier connections bounded? | The integration boundary and the person responsible for reviewing access beyond it. |
| Who reviews supplier activity or notifications? | Available monitoring evidence, incident notifications and the escalation owner. |
| Which software dependencies matter to this relationship? | Relevant component information, update responsibilities and known information gaps. |
For suppliers providing software, identify whether component information, including an available software bill of materials, is relevant to the decision. A named engineering owner should review the information and unresolved questions. Build pipelines, package sources, developer extensions and remotely managed tooling belong in the review boundary when their access or dependencies are relevant to the scoped relationship.
The vendor risk program records the evidence and resulting actions. Technical testing, deployment changes and continuously operated monitoring need their own agreed scope and responsible specialists.
08
A Risk Decision Your Team Can Explain
For each pilot vendor, the register brings together the service owner, risk tier, evidence reviewed, outstanding questions and the person with authority to accept the risk. The management readout makes the next action clear: obtain more evidence, track a correction or document an acceptance decision under your agreed authority.
Record the reason for the decision, any conditions, the action owner and the next review date. Where evidence is missing, show the gap rather than treating an unanswered question as a satisfactory control.
An issue that may affect onboarding, access or continued use needs an escalation path. The program defines who receives it, what information they need and who decides the next action. Your team's response and any conditions remain in the decision record.
09
Set the Review Boundary Before Sharing Evidence
Start the vendor review before an onboarding or renewal decision becomes urgent. Agree the vendor list, services, evidence requested, business owner and decision date. That gives your team time to address missing information and set any conditions before accepting the relationship.
Before confidential documents are shared, agree the permitted recipients, transfer method and retention or return requirements. Resolve any required confidentiality agreement first. Request only the information needed for the review; credentials, live customer records and unnecessary personal information should not be included in a routine evidence pack.
Planning an acquisition or investment? Discuss the target organization, decision and evidence you need with Temi so the review can be tailored to that transaction.
10
Connect the Inventory to the Review
A vendor list is more useful when it can be reconciled with how the business actually buys services and grants access. Bring together purchasing and payment records, the application inventory, external-access records and input from department owners. Resolve duplicate supplier names and identify services that have no recorded owner. Include free tools where their access or data use brings them within your agreed scope.
For each relationship, record the service, owner, relevant data and access, material dependencies, contract and renewal information, evidence status and next review date. Where several obligations apply, keep a common supplier record and identify the requirements relevant to each relationship. Your legal and privacy advisers confirm jurisdiction-specific requirements.
11
Connect Vendor Evidence to the Audit Plan
Use the vendor register to make supplier dependencies visible in the audit plan. Link each material service to the controls your organization relies on, the assurance available and the responsibilities your own team must perform. Findings then feed the same risk and remediation record used for onboarding and renewal decisions.
When a vendor’s report is missing, a certificate has expired or an exception affects your service, we help your team document the concern and decide the next step. That may mean requesting clarification or additional assurance, agreeing corrective action, or recording a risk acceptance decision.
12
Third-Party Risk Program Timeline
| Phase | Timing | What happens |
|---|---|---|
| Inventory | Week 1 | Vendor list, data map, existing contracts and reviews gathered and tiered |
| Design | Weeks 2 to 3 | Due-diligence standard by tier, SOC report review method, scoring model and acceptance authority |
| Pilot | Within the scoped 4- or 6-week engagement | Method applied to the agreed set of highest-tier vendors; decisions recorded |
| Hand over | Final week | Program document, templates, register, operating cadence and management readout |
| Operate | Ongoing | Your team runs the cadence; ongoing operation continues through Virtual CISO where you want it |
13
How the Engagement Runs
Strategy Call. Spend 30 minutes directly with Temi to discuss your vendor base, the requirement driving your program and the frameworks it needs to satisfy. Get a clear recommendation for building your vendor risk program.
Inventory and Tiering. Vendors inventoried against the data they touch, the services they provide and how hard they are to replace; tiers defined and the critical-vendor shortlist agreed.
Design and Pilot. The due-diligence standard, SOC report review framework, scoring model and acceptance authority designed with you and applied to the pilot vendors, with every decision recorded.
Hand Over. Program document, templates, register, operating cadence and management readout delivered to the owner who will run the program.
Our commitment. Receive a clear vendor risk program in 4–6 weeks, with practical templates, documented review decisions and a management readout. We walk your team through the deliverables and next steps, with 30 days of follow-up access and the scheduled calls included in your program.
14
Third-Party Risk Management Pricing
| Essentials | Most Popular Comprehensive |
|---|---|
| From $6,000 setup | From $10,000 setup |
| Vendor inventory and tiering criteria · Up to 10 scoped vendor reviews · Due-diligence standard by tier · SOC report review framework (template) · Risk scoring model and register · Program document · Management readout · 30 days of follow-up access, 1 call | Everything in Essentials, with up to 25 vendor reviews · SOC report review applied to assessed vendors at the agreed depth · Remediation tracking and acceptance authority · Contract risk review support and clause library by tier · TPRM platform selection · Reporting template and management review readout · 30 days of follow-up, 2 calls |
| 4 weeks | 6 weeks |
| Up to 10 vendors | Up to 25 vendors |
| Discuss Third-Party Risk Management | Discuss Third-Party Risk Management |
We build your vendor risk program with clear assessment criteria, structured evidence reviews and practical guidance for vendor decisions. You receive a reusable SOC report review framework, with applied SOC report reviews and contract risk guidance included in the full program.
Receive a fixed-price proposal with a clear scope, delivery schedule and 30 days of follow-up access.
15
Who Needs Third-Party Risk Management
Organizations whose customers or auditors have asked for the vendor risk program
Groups where business units assess the same vendor differently
Companies that have had a vendor incident and want one owner and one method for vendor decisions
Payments and healthcare companies whose supplier responsibility must be proven to an assessor
16
Why Companies Choose Cyvelle for Third-Party Risk
Consistent vendor decisions. We give your teams a common review method, risk scoring and reporting structure so you can prioritize vendors and explain your decisions.
Audit-informed guidance. With experience assessing vendor management and building programs across industries, we connect your reviews and evidence to the questions customers and auditors ask.
Framework-aligned reviews. We map your program to applicable SOC 2 criteria, ISO 27001 Annex A controls, PCI DSS and HITRUST requirements.
A program you keep. Your documents, templates and review method stay with your business, ready for new vendors and future assessments.
Led by Temi. You work directly with Temi throughout the engagement, backed by over 2 decades of experience and over 100 assessments.
Clear, fixed pricing. The scope and delivery schedule are agreed upfront.
Know Which Third Parties Require Attention
Discuss your vendor base, customer requirements and deadlines with Temi. Get a clear plan for building your vendor risk program and a fixed-price proposal for the work.
Free 30-minute third-party risk strategy call. No obligation.
Backed by 30 days of follow-up access.
17Book your scoping call
Get Your Vendor Risk Plan
Choose a time for your free 30-minute scoping call.
18
Third-Party Risk Management FAQ
Which requirements does a vendor risk program satisfy? Customer and assurance requirements drive supplier oversight; PCI DSS includes scoped service-provider obligations, while HIPAA requires applicable business-associate agreements. The program document maps to the criteria you are assessed against.
How long does it take? We build your vendor risk program in 4–6 weeks, including a pilot review of your highest-risk vendors. You receive the program document, practical templates, documented decisions and a management readout.
How much does it cost? Third-party risk management starts at $6,000. Receive a fixed-price proposal with a clear scope, delivery schedule and 30 days of follow-up access.
What does a vendor SOC report review cover? Report type and period, the auditor’s opinion, exceptions, subservice organizations carved out of scope, the complementary user entity controls your own team must perform, and any bridge letter’s management representation, with the evidence gap clearly identified.
When is a TPRM platform worth it? We build your vendor risk process, templates and register. If your team needs a platform to manage vendor reviews and evidence, our full program includes help selecting one that fits your needs.
Who runs the program after the engagement? We can hand over the program document, templates and review schedule to your team. Most of our clients continue with our Virtual CISO service, where we manage vendor reviews, track follow-up actions and keep the program current as their business grows.
When should vendor due diligence start? Start before onboarding or renewal commitments become urgent. Agree the service, risk tier, required evidence, owner and decision date early enough to investigate gaps and record any conditions.
Is a SOC report enough to approve a vendor? The report is one input. Check whether its scope and period cover the service you use, examine exceptions and your own required controls, and record relevant changes or missing evidence. Acceptance follows your risk authority and the full evidence record.
What if the vendor will not share enough evidence? We help your team identify the missing evidence, understand its significance and request clarification or alternative assurance. You receive a clear record to support decisions about corrective action, conditions for using the vendor or selecting another supplier.
Does the review include software dependencies? We agree which supplier software and dependencies are relevant to your vendor decision. Available component information and supplier evidence inform the record, with missing information assigned to an owner. Engineering assessment and technical testing are separately scoped where needed.
What happens when a serious concern appears during a review? We help your team document the concern, understand the affected service and organize the available evidence. A clear escalation process helps the people responsible decide what action to take before onboarding a vendor or continuing to use its services.
How should confidential supplier information be handled? Agree the evidence needed, approved recipients, transfer method and retention or return expectations before exchange. Resolve required confidentiality terms and avoid including credentials or unnecessary personal information. Confirm the actual arrangements in the engagement scope.
Does this cover acquisition or investment due diligence? Planning an acquisition or investment? Discuss the target organization, decision and evidence you need with Temi so the review can be tailored to that transaction.
- The Governance Blueprint
- Vendor Security Questionnaire Support
- Virtual CISO
- SOC 1 & SOC 2 Readiness
- Pricing
19
Choose the Right Starting Point
| Your immediate need | Best fit | What it provides |
|---|---|---|
| Assess your own suppliers | Third-Party Risk Management | Vendor tiers, evidence review, documented decisions and operating ownership |
| Answer a customer about your controls | Vendor Security Questionnaire Support | A supported response, gap decisions and evidence references |
| Understand wider security gaps | The Governance Blueprint | An assessment and prioritized action plan |
| Run the program month to month | Virtual CISO | An ongoing leadership arrangement with capacity and responsibilities agreed separately |
20
What Happens After Delivery
Your program includes 30 days of follow-up access and scheduled calls to clarify the deliverables, answer questions and help your team put the program into practice.
21
Start With the Requirement and Deadline
Bring the vendor list, the audit or customer request and your decision deadline. We will discuss the right scope for your supplier program.
Free 30-minute third-party risk strategy call. No obligation.
Free 30-minute strategy call with Temi. Get a clear plan for your vendor risk program.