Scope Enterprise Active

Third-Party & Supply Chain Security

To manage the security and privacy risks associated with third-party vendors and partners.

Domain ID
DOM-024
Domain Code
TPR
Business Owner
Vendor Risk Management

Domain Overview

TPR · Full Domain Profile
Short Overview

Establishes the processes for managing security and compliance risks associated with third-party vendors, suppliers, and the extended supply chain.

Description

Establishes a program to assess, monitor, and manage risks throughout the vendor lifecycle, including due diligence, contract requirements, ongoing monitoring, and offboarding.

Why This Domain Matters

Supply chain compromises are increasing, while many organizations lack visibility into their extended vendor ecosystem and cannot effectively assess fourth-party risks.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        TPR · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        6 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        TPR-001 Third-Party Risk Management Program Establishes TPRM program including gover...
        Administrative
        Detective
        		 Critical Active 📋 10 Reqs View →
        TPR-002 Third-Party Risk Assessment & Due Diligence Establishes third-party due diligence in...
        Administrative
        Detective
        		 Critical Active 📋 10 Reqs View →
        TPR-003 Third-Party Contract & Compliance Management Establishes third-party contract managem...
        Administrative
        Detective
        		 High Active 📋 10 Reqs View →
        TPR-004 Third-Party Continuous Monitoring & Assurance Establishes third-party monitoring inclu...
        Operational
        Detective
        		 High Active 📋 10 Reqs View →
        TPR-005 Third-Party Lifecycle & Offboarding Management Establishes third-party lifecycle manage...
        Administrative
        Preventive
        		 High Active 📋 10 Reqs View →
        TPR-006 Third-Party Concentration Risk Management Establishes concentration risk managemen...
        Administrative
        Detective
        		 High Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        60 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        TPR-001-R001 TPRM Governance Framework The organization shall establish a Third... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R002 Program Scope The organization shall define a document... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R003 Third-Party Classification The organization shall establish a class... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R004 Roles & Responsibilities The organization shall clearly define an... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R005 Risk Governance The organization shall establish governa... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R006 Program Metrics The organization shall define and track... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R007 Executive Reporting The organization shall provide executive... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R008 Program Review The organization shall conduct periodic... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R009 Program Compliance The organization shall ensure the TPRM p... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-001-R010 Continuous Improvement The organization shall establish a conti... TPR-001 Third-Party Risk Management Pr... Third-Party Risk Management, Procurement, Risk Management, CISO View ↗
        TPR-002-R001 Due Diligence Framework The organization shall establish a due d... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R002 Vendor Risk Assessment The organization shall conduct comprehen... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R003 Security Assessment The organization shall conduct security... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R004 Privacy Assessment The organization shall conduct privacy a... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R005 Financial Assessment The organization shall conduct financial... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R006 Risk Scoring The organization shall apply risk scorin... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R007 Risk Acceptance The organization shall accept third-part... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R008 Assessment Reporting The organization shall report on third-p... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R009 Assessment Review The organization shall conduct periodic... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-002-R010 Continuous Improvement The organization shall establish a conti... TPR-002 Third-Party Risk Assessment &... Third-Party Risk Management, Information Security, Privacy, Finance, Compliance View ↗
        TPR-003-R001 Contract Requirements The organization shall establish contrac... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R002 Security Clauses The organization shall include security... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R003 Privacy Clauses The organization shall include privacy c... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R004 Audit Rights The organization shall include audit rig... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R005 Regulatory Obligations The organization shall include regulator... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R006 SLA Management The organization shall establish and man... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R007 Compliance Verification The organization shall verify third-part... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R008 Contract Review The organization shall conduct periodic... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R009 Contract Maintenance The organization shall maintain third-pa... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-003-R010 Continuous Improvement The organization shall establish a conti... TPR-003 Third-Party Contract & Complia... Procurement, Legal, Third-Party Risk Management, Compliance, Information Security View ↗
        TPR-004-R001 Monitoring Framework The organization shall establish a third... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R002 Continuous Risk Monitoring The organization shall continuously moni... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R003 Security Performance Monitoring The organization shall monitor third-par... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R004 Incident Coordination The organization shall coordinate securi... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R005 Fourth-Party Oversight The organization shall oversee fourth-pa... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R006 Compliance Monitoring The organization shall monitor third-par... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R007 Performance Reporting The organization shall report on third-p... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R008 Assurance Reviews The organization shall conduct periodic... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R009 Monitoring Review The organization shall conduct periodic... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-004-R010 Continuous Improvement The organization shall establish a conti... TPR-004 Third-Party Continuous Monitor... Third-Party Risk Management, Security Operations, Procurement, Service Management View ↗
        TPR-005-R001 Vendor Onboarding The organization shall onboard third-par... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R002 Relationship Management The organization shall manage third-part... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R003 Change Management The organization shall manage changes in... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R004 Contract Renewal The organization shall manage third-part... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R005 Vendor Termination The organization shall terminate third-p... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R006 Data Return The organization shall return organizati... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R007 Data Destruction The organization shall ensure the destru... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R008 Access Revocation The organization shall revoke third-part... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R009 Offboarding Verification The organization shall verify that all o... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-005-R010 Continuous Improvement The organization shall establish a conti... TPR-005 Third-Party Lifecycle & Offboa... Third-Party Risk Management, Procurement, Legal, IT Operations, Information Security View ↗
        TPR-006-R001 Concentration Risk Framework The organization shall establish a third... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R002 Critical Dependency Identification The organization shall identify critical... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R003 Concentration Assessment The organization shall conduct concentra... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R004 Geographic Concentration The organization shall assess geographic... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R005 Technology Concentration The organization shall assess technology... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R006 Mitigation Planning The organization shall develop mitigatio... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R007 Concentration Monitoring The organization shall monitor concentra... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R008 Concentration Reporting The organization shall report on concent... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R009 Periodic Review The organization shall conduct periodic... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗
        TPR-006-R010 Continuous Improvement The organization shall establish a conti... TPR-006 Third-Party Concentration Risk... Third-Party Risk Management, Enterprise Risk, Procurement, Operational Resilience View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED ISO 28000 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        MAPPED NIST SP 800-161 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST-CSF NIST CSF (ID.SC) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        MAPPED CMMC Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        SOC2 SOC 2 SOC 2 is an independent examination and...
        AICPA
        Audit Framework
        		 vLatest View →
        GDPR GDPR (Article 28) The General Data Protection Regulation i...
        EU
        Regulation
        		 vCurrent View →
        DORA DORA The EU Digital Operational Resilience Ac...
        EU
        Regulation
        		 vCurrent View →
        MAPPED CISA Cybersecurity Supply Chain Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —