WEBVTT

1
00:00:00.612 --> 00:00:11.996
Welcome to NxSAM training. This module covers Third-Party Risk Management: assessing the suppliers, vendors and partners your organisation depends on.

2
00:00:12.286 --> 00:00:28.233
The reason it exists is simple to state. Most organisations have spent a decade hardening what they run, and comparatively little on what they depend on - and an attacker does not care which side of a contract a weakness sits on.

3
00:00:28.835 --> 00:00:39.070
The difference from every other module is that you cannot scan a vendor. You have to ask them, and then decide how much of the answer to believe.

4
00:00:39.650 --> 00:00:42.757
Everything starts from the vendor record.

5
00:00:43.335 --> 00:00:56.185
The list carries the vendor's details, its pre-assessment details, the client it belongs to, the last audit it was associated with, its criticality, its score, and who created it.

6
00:00:56.768 --> 00:01:12.065
Read criticality and last associated audit together, because that pair is your whole assurance gap in one glance. A vendor marked critical whose last assessment was two years ago is the row that matters on this screen.

7
00:01:12.674 --> 00:01:27.229
Vendor score is the summary of how they did. Treat it as a starting point for a conversation rather than a verdict - a good score against a narrow scope is worth less than a mediocre one against a thorough assessment.

8
00:01:27.825 --> 00:01:42.429
A vendor is the organisation. Vendor users are the people at that organisation who will actually answer your questions - because an assessment is not sent to a company, it is sent to a person who has to fill it in.

9
00:01:43.017 --> 00:01:58.748
That distinction has a practical consequence worth planning for. People leave vendors more often than vendors leave you, so keep more than one contact - an assessment stalled on a departed employee is the commonest delay in this module.

10
00:01:59.338 --> 00:02:23.805
Which fields that form shows is a setting, not a property of the form. Under RLCM Configuration, Vendor User Form Setting offers a Basic form - only the core fields, for quick onboarding - or an Advanced one that adds the user type, roles, status, landing page, IP group and allowed audit type, with a separate switch for one-time-password login.

11
00:02:24.414 --> 00:02:48.619
A vendor user created under Basic gets the defaults for everything Advanced would have asked. If a vendor user can see more or less than intended, this is where to look first. And on the vendor itself, the email is optional: given, it links or creates the vendor's default user; left blank, one can be added later from this list.

12
00:02:49.228 --> 00:03:02.440
Vendor properties are the fields your organisation records about a supplier: what they provide, which data they touch, whether they are business critical. Those are what make triage possible later.

13
00:03:03.045 --> 00:03:20.599
They are yours to define, and the ones worth adding are the ones you will want to filter by in a hurry. When a breach is announced at a well-known supplier, the question within the hour is which of our vendors depend on them - answerable only if somebody recorded it as a field.

14
00:03:21.196 --> 00:03:26.511
Then comes the step that decides how much work everything after it will be.

15
00:03:27.084 --> 00:03:36.622
A pre-assessment is a short set of questions asked before the full assessment, to work out how much scrutiny this supplier actually warrants.

16
00:03:37.221 --> 00:03:53.601
The reasoning is practical. A stationery supplier and a payment processor are both third parties, and assessing them identically means either wasting effort on one or under-assessing the other. Most organisations do both at once.

17
00:03:54.237 --> 00:04:04.951
The list shows each one with its vendor, its scorecard, whether it has been submitted, its scope, a computed tier, a final tier, and its status.

18
00:04:05.541 --> 00:04:13.399
Computed tier and final tier are two columns rather than one, and understanding why is the point of this whole screen.

19
00:04:13.979 --> 00:04:26.686
The computed tier is what the scorecard produced from the vendor's answers - arithmetic, applied identically to everyone. The final tier is what your organisation decided.

20
00:04:27.299 --> 00:04:39.622
Usually they match. When they do not, somebody has overridden the model, and keeping both visible means that override is a recorded decision rather than an invisible one.

21
00:04:40.202 --> 00:05:01.548
Which makes the gap between the two columns worth auditing occasionally. A handful of overrides is judgement. A pattern of them - always in the same direction, always downward - means your scorecard does not reflect what your organisation actually believes, and it should be changed rather than routinely ignored.

22
00:05:02.134 --> 00:05:19.927
The four cards above the list count the same population four ways: eight in total, four complete, three still being answered, and three waiting on a human. That last one is the queue that matters - a computed tier nobody has accepted or overridden yet.

23
00:05:20.525 --> 00:05:26.250
Opening one that is still being answered shows where the answers actually come from.

24
00:05:26.875 --> 00:05:45.416
Twelve questions across four sections, each with the supplier's answer, the evidence they attached, and where it has reached. The live score updates as answers arrive - a hundred and nine out of a hundred and sixty here - so the tier is visible before the questionnaire is finished.

25
00:05:46.000 --> 00:06:01.106
The chips split the same twelve by who is holding them up: two pending on you, seven already accepted, three saved but not submitted. Chasing a supplier is then a specific request rather than a general reminder.

26
00:06:01.681 --> 00:06:11.675
The scorecard configuration is where you decide what counts - which questions matter, how much each is worth, and where the boundaries between tiers fall.

27
00:06:12.258 --> 00:06:24.654
That is worth agreeing deliberately and rarely. A tiering model everyone argues with gets overridden case by case, and once that starts the tiering has stopped meaning anything.

28
00:06:25.270 --> 00:06:36.201
The pre-assessment summary is where you see the outcome across the supplier base - which suppliers landed in which tier, and therefore where the assessment effort is going to go.

29
00:06:36.835 --> 00:06:48.485
The assessment itself is a questionnaire, built from controls in the same way a compliance template is - and that is not an analogy. It runs on the same machinery.

30
00:06:49.101 --> 00:06:59.360
The audit list is the same shape as the compliance one: audit information, status, progress, findings, an assessment summary and an audit score.

31
00:06:59.997 --> 00:07:13.831
Which means the score behaves the same way, and the same warning applies. Every unanswered question is already counted in what was available, so a vendor who has not replied yet scores near zero.

32
00:07:14.425 --> 00:07:33.612
That matters more here than in an internal audit, because you are waiting on somebody outside your organisation. Read the progress column before drawing any conclusion about a supplier - a low score often means an unresponsive vendor, which is its own finding, but a different one.

33
00:07:34.204 --> 00:07:45.471
The vendor answers, and attaches evidence. You review both. And the thing to hold on to throughout is that an answer and evidence are different claims.

34
00:07:46.073 --> 00:08:03.389
Yes, we encrypt data at rest is an assertion. A configuration extract, a policy document, or a recent audit report is evidence. A questionnaire full of yeses with nothing attached tells you the vendor knows what you wanted to hear.

35
00:08:03.984 --> 00:08:20.052
Where a vendor's answers are inadequate, the finding is raised against the vendor and tracked like any other - which is the point of doing this inside the platform rather than in a spreadsheet, because it ages, it has an owner, and it appears in reporting.

36
00:08:20.656 --> 00:08:28.467
One capability in this module is worth understanding properly, because it changes how much of this work is manual.

37
00:08:28.730 --> 00:08:42.299
Vendors do not answer your questionnaire. They answer the questionnaire they have already answered forty times, and send you their existing S O C two report or I S M S documentation instead.

38
00:08:42.895 --> 00:08:56.153
The similarity capability reads that existing material and matches it against your control set, so a control the vendor has already evidenced elsewhere does not have to be asked again from scratch.

39
00:08:56.758 --> 00:09:07.929
It works in two stages - a broad pass to find candidates, then a precision pass to confirm them - and it can be run for a single control or across a whole assessment.

40
00:09:08.532 --> 00:09:23.186
Treat the result as a draft rather than an answer. What it saves is the reading, not the judgement: someone still has to decide whether the evidence the vendor supplied actually satisfies the control you asked about.

41
00:09:23.787 --> 00:09:42.948
That is Third-Party Risk. A vendor record with real people attached, a pre-assessment that decides how hard to look, a scored tier that directs your effort, a questionnaire answered with evidence rather than assertions, and matching that reuses what the vendor has already produced.

42
00:09:43.530 --> 00:09:55.252
The habit worth building is the one about evidence. Assertions are free and every vendor supplies them. What you are actually assessing is what they can show you.