Run vendor and third-party security risk properly, without a team of ten
For procurement, security, privacy and operations leads in companies of 20 to 1,000 people: a 29-sheet workbook, self-scoring questionnaires, 5 fillable forms, brand-ready templates and an e-book that follows one payments company from a bank's question to a running programme.
- A 29-sheet master workbook: tiering by formula, residual risk, findings, decision log, contract coverage, concentration and a dashboard with seven charts
- Short (20) and full (60) vendor questionnaires that score themselves, with knockout questions
- A policy with 12 procedures, a contract schedule starter for counsel and a leadership memo with risk acceptance
- 36 messages with a trust pack for your own customers, 30 AI prompts, a team briefing and a 14-question LMS-ready knowledge check
The Third-Party and Vendor Security Risk Kit · Bodhih Pro Kits · 321 by Bodhih Training, trainers to 2,000+ companies since 2008.
How do you manage vendor security risk in a small company?
Build an inventory of every supplier that holds or reaches your data or systems, tier each by data, access, criticality and regulation, review at the depth the tier needs, sign risk acceptances at the right level, fix contracts, monitor and plan exits. The Third-Party and Vendor Security Risk Kit from Bodhih Training gives you the files for each step.
Want the full free guide first? Read How to run third-party vendor risk management in a small company.
You already feel the problem. Here is what it is costing you.
Nobody has the list
Contracts live in inboxes, tools are bought on cards and free AI add-ons arrive by update. When a bank or customer asks for your inventory, you have to build it from scratch.
Every vendor gets the same questionnaire
One huge spreadsheet for everyone means the critical vendors are reviewed no better than the trivial ones, and half never reply.
Reports you cannot read with confidence
A SOC 2 report arrives as a 90-page PDF. You read the opinion and file it, and never find the exception or the controls it expects you to run.
Contracts that say 'promptly'
Breach notice with no hours, no exit help, no word on subprocessors or AI training. You find out what the contract does not say on the worst day.
Picture the next few weeks with the kit open beside you.
Imagine the Friday your bank's review is due. You open the Dashboard and read, in numbers and colours, how many vendors you have, which are critical, which reviews are current and which findings are open, each with a name and a date.
As you send the pack, you notice something: the questions the bank will ask already have answers. Who your critical vendors depend on. Which contracts give you notice in hours. Who accepted which risk, and until when.
When your own customer's questionnaire arrives the next week, open the trust pack, send it first, and answer only the rows it does not cover.
Whether you start with the inventory tonight or the business case at Monday's meeting, the Start-here map tells you which file to open next.
23 files that do the work for you
The e-book shows you how. The tools make it happen. Here is exactly what you download.
The Third-Party and Vendor Security Risk Kit (e-book, PDF)
The guide: methods, worked examples, scripts and exercises
Start here: vendor risk map
The job in ten steps with the file for each, your first hour, your first week, the 30/60/90-day plan and yearly cycle, the 'Brand it in five minutes' box and what is in the kit.
Vendor Risk Master Workbook
29-sheet workbook: Settings, 0-4 self-assessment with ranked gap plan, vendor inventory with tiering by formula, due diligence and residual risk, findings, decision log, contract clause coverage, monitoring, fourth parties, concentration, AI vendors, evidence register, customer questionnaires, a three-sheet business case, RACI, roadmap, crosswalk, sources, glossary, What changed log and a dashboard with seven charts.
Vendor due diligence questionnaires (short and full)
Self-scoring questionnaires to send to vendors: 20 questions for Tier 3, 60 in 12 domains for Tier 1 and 2, weights, knockout questions, score by domain, an evidence request list and a dashboard with three charts.
Vendor intake and tiering request
Three-page fillable request a business owner completes before any contract or card spend: what the vendor does, the data and access involved, how critical it is, AI use, the four-factor tier score and the procurement gate decision.
Assurance report review record
Four-page fillable record for reading a vendor's SOC 2 report, ISO/IEC 27001 certificate or other evidence in about 30 minutes: scope match, period and age, opinion, exceptions, CUECs, subservice organisations, certificate checks and the conclusion.
Findings and risk acceptance record
Two-page fillable record: the finding in facts, the options considered, the residual risk, compensating controls, the approver at the right level and the end date of any acceptance.
Vendor onboarding, offboarding and exit plan
Four-page fillable set: the go-live checklist, the offboarding record with data deletion confirmation, and an exit plan for a critical vendor with triggers, a stressed-exit playbook and a paper test record.
Vendor incident and breach notice record
Three-page fillable record for an incident at a vendor or its subprocessors: first notice and the questions to ask, impact on our data and services, the notification decision with deadlines by law and contract, and the post-incident review of the vendor.
Third-party risk policy and procedure starter
Brand-ready one-page third-party risk policy with a risk appetite table and 12 short procedures (intake, tiering, due diligence, findings, contracting, onboarding, monitoring, fourth parties, AI vendors, incidents, exit, supplier side), each with steps and the records it creates.
Vendor security and data protection schedule starter
Brand-ready discussion sheet for counsel: processing terms, security measures, incident notice in hours, assurance and audit, subprocessors, data location, continuity, AI and no-training terms, exit and data return, a financial-sector add-on (DORA, OSFI B-10, CPS 230 themes) and the clause checklist that feeds the workbook.
Leadership sign-off and risk acceptance memo
Brand-ready four-part template: the decision memo with options, costs and risk appetite; a one-page quarterly report; the High residual risk acceptance; and a yearly third-party risk statement for a sponsor bank, partner or board.
Vendor risk message library and trust pack
36 brand-ready messages for business owners, finance, vendors, leadership and your own customers, a nine-part trust pack outline and a 25-answer questionnaire bank for the supplier side.
Worked example pack: Northbeam Payments
The kit's main files completed for one composite 180-person payments company in Toronto: decision and business case, inventory and tiering, self-assessment, due diligence, findings and acceptances, contracts, a fourth-party breach, concentration, the supplier side and the week-12 position.
AI prompt pack for vendor risk
30 prompts with placeholders grouped by step (inventory and tiering, due diligence, findings, contracts, lifecycle, fourth parties, AI vendors, incidents, supplier side, governance), each with what to paste in, what to check, and four human-review rules.
Team briefing session plan and answer key
A 45-minute briefing plan for business owners, finance and IT, facilitator notes, LMS import notes, the printable answer key for the 14-question knowledge check and an attendance record.
Numbers that matter: vendor risk KPI card
14 numbers with plain-words definition, formula, where each lives in the workbook and what to do when it moves, plus a flow mini-infographic.
Vendor risk decision card and mistakes to avoid
Thirteen 'if this, do that' decisions with the file to open and fifteen mistakes with what to do instead.
Reading SOC 2 reports and ISO certificates card
A 20-minute reading order for SOC 2 reports, the terms in plain words, five checks for ISO/IEC 27001 certificates, seven red flags and what to do when there is no report.
Vendor risk rules by market (November 2026)
Dated sheet: the rules that drive third-party risk in the EU, UK, US, Canada, Australia, New Zealand and internationally, what they ask, the position and dates at November 2026 and the official sources.
Vendor risk knowledge check (LMS-ready)
14 scenario questions with four options, the correct letter and an explanation; imports into Bodhih LMS or any LMS that accepts CSV quizzes.
Vendor risk 12-week plan and yearly cycle (calendar)
35 calendar events: twelve weekly programme meetings, monthly monitoring hours, quarterly leadership reports and reconciliations, re-reviews, exit plan tests, a vendor breach tabletop, the concentration review and the yearly policy review.
Vendor risk task board (CSV import)
40 tasks with phase, owner role, start and due week, labels and the kit file to use; imports into Trello, Asana, Notion, Planner or Jira.
Chapter by chapter
Each chapter opens with a real situation, gives you a method and ends with something to do today, using the tools in your kit.
- Format
- PDF e-book + XLSX + fillable PDF + DOCX + printable PDF + ICS + CSV
- Files
- 23 files plus a one-click ZIP
- E-book
- 74 pages
- Works with
- Excel, Google Sheets, Apple Numbers, LibreOffice, Word, Google Docs, Acrobat Reader, Google Calendar, Outlook, Apple Calendar, Trello, Asana, Notion, Planner, Jira, Bodhih LMS and most LMS quiz importers
- Best for
- Small and mid-size companies (about 20 to 1,000 people) running third-party security and privacy risk, and suppliers answering customers' reviews
Why vendor risk lands on your desk
Why accountability for suppliers stays with you, the regulatory pull in six markets, an honest baseline and a business case with the low case first.
Find every supplier
Building the inventory from accounts payable, cards, single sign-on and contracts, and a procurement gate that keeps it current.
Tier by data, access and criticality
Four-factor tiering with a criticality override, and what each tier triggers.
Questionnaires sized to the tier
Short and full questionnaires that score themselves, knockout questions and letting reports answer what they can.
Reading SOC 2 reports, ISO certificates and other evidence
Reading a SOC 2 report in twenty minutes, checking ISO/IEC 27001 certificates and what to do when there is no report.
Findings, scores and risk acceptance
Findings with owners and dates, residual risk by formula and risk acceptance at the right level with an end date.
Contracts that carry the weight
Processing terms, security schedule, breach notice in hours, audit, subprocessors, AI and exit terms, fixed one renewal at a time.
Onboarding, monitoring, incidents and exit
Go-live checks, monitoring signals between reviews, vendor incidents on your own clock, clean offboarding and exit plans.
Fourth parties, concentration and AI vendors
Subprocessor lists, concentration on shared providers and four extra questions for AI vendors.
The supplier side, the board report and the yearly cycle
Answering your own customers with a trust pack, the quarterly board report and the yearly cycle.
Not just reading. Tools you will actually open again.
Start here
- 00-Start-Here-Vendor-Risk-Map.pdf: the job in ten steps with the file for each, your first hour, your first week, the 30/60/90-day plan, the yearly cycle and the 'Brand it in five minutes' box
Workbooks
- Vendor-Risk-Master-Workbook.xlsx: 29 sheets including Settings, a 0-4 self-assessment with ranked gap plan, vendor inventory with tiering by formula, due diligence and residual risk, findings, decision log, contract clause coverage, monitoring, fourth parties, concentration, AI vendors, evidence register, customer questionnaires, a three-sheet business case calculator, RACI, roadmap, jurisdiction crosswalk, official sources register, glossary, What changed and a dashboard with seven charts and traffic lights
- Vendor-Due-Diligence-Questionnaires-Short-and-Full.xlsx: self-scoring 20-question short and 60-question full questionnaires with weights, knockout questions, score by domain, an evidence request list and a dashboard
Fillable forms
- Vendor-Intake-and-Tiering-Request.pdf: what the business wants to buy, the four-factor score, AI use and the procurement gate decision
- Assurance-Report-Review-Record.pdf: reading a SOC 2 report or ISO/IEC 27001 certificate: scope, period, opinion, exceptions, CUECs, subservice organisations, conclusion
- Findings-and-Risk-Acceptance-Record.pdf: the finding, options, compensating controls, residual risk and sign-off with an end date
- Vendor-Onboarding-Offboarding-and-Exit-Plan.pdf: go-live checklist, offboarding with deletion confirmation, and a two-page exit plan with a paper test record
- Vendor-Incident-and-Breach-Notice-Record.pdf: first-notice questions, impact, the notification decision and the post-incident vendor review
Word templates
- Third-Party-Risk-Policy-and-Procedure-Starter.docx: a one-page policy with risk appetite table and 12 short procedures
- Vendor-Security-and-Data-Protection-Schedule-Starter.docx: plain-words contract positions for counsel, with a financial-sector add-on and the clause checklist
- Leadership-Sign-Off-and-Risk-Acceptance-Memo.docx: decision memo, quarterly report, High risk acceptance and a yearly third-party risk statement
- Vendor-Risk-Message-Library-and-Trust-Pack.docx: 36 messages, a trust pack outline and a 25-answer bank for the supplier side
- Worked-Example-Pack-Northbeam-Payments.docx: the main files completed for one composite 180-person payments company
- AI-Prompt-Pack-for-Vendor-Risk.docx: 30 prompts with what to paste in, what to check and four human-review rules
- Team-Briefing-Session-Plan-and-Answer-Key.docx: a 45-minute session plan, facilitator notes, the printable answer key and an attendance record
Team training (LMS-ready)
- Vendor-Risk-Knowledge-Check.csv: 14 scenario questions in question, option_a to option_d, correct, explanation format
Cheat sheets
- Numbers-That-Matter-Vendor-Risk-KPI-Card.pdf: 14 numbers with formulas and what to do when they move
- Vendor-Risk-Decision-Card-and-Mistakes.pdf: 13 'if this, do that' decisions and 15 mistakes to avoid
- Reading-SOC-2-Reports-and-ISO-Certificates-Card.pdf: the 20-minute reading order, ISO checks, red flags and what to do with no report
- Vendor-Risk-Rules-by-Market-November-2026.pdf: dated sheet for the EU, UK, US, Canada, Australia, New Zealand and international frameworks
Calendar and import
- Vendor-Risk-12-Week-Plan-and-Yearly-Cycle.ics: 35 calendar events
- Vendor-Risk-Task-Board.csv: 40 tasks for Trello, Asana, Notion, Planner or Jira
E-book
- The Third-Party and Vendor Security Risk Kit e-book: about 10,500 words, 10 chapters and 24 figures
When you have worked through it, you will be able to…
Every outcome is practised with a worked example and a tool, not just described.
- Build a vendor inventory from accounts payable, cards, sign-on and contracts, and keep it current with a procurement gate
- Tier every vendor with the same four factors and a criticality override
- Send short or full questionnaires that score themselves and flag knockouts
- Read a SOC 2 report in twenty minutes and check an ISO/IEC 27001 certificate
- Turn gaps into findings and sign risk acceptances at the right level with end dates
- Mark every critical contract against a clear schedule and fix the weakest clauses at renewal
- Map fourth parties, see concentration and check AI vendors before use
- Answer your own customers from a dated trust pack and run the yearly cycle
Know your starting point. Prove your progress.
People who measure before and after improve faster and can show it. AssessAll, our sister assessment platform, has AI-graded assessments that pair with this kit. Take one now, work through the kit, then re-take it.
Third-Party and Vendor Assurance Assessment for Procurement, Security and Risk Teams
Take the assessment →AssessAll assessmentData Governance & Data Quality Stewardship Judgment
Take the assessment →AssessAll assessmentDecision-Making Under Uncertainty
Take the assessment →JobularyIf-then plans that make habits stick (Jobulary)
Make it a growth plan →A taste of Chapter 4
DataLake Analytics, Northbeam's data warehouse provider and a Tier 2 vendor, returned the full questionnaire in week 10. It scored 86% overall, comfortably above Rachel's 80% pass mark. The Full score sheet showed people and training, and hosting, at 100%. Access and identity scored 50%. The reason was one answer: support administrators at DataLake were exempt from MFA "for operational reasons". That was a knockout. Rachel raised finding F-13, High, with a fix date of 15 April, and left the decision Pending. The vendor's account manager asked whether 86% was not enough. Rachel replied that the score was a signal; the knockout was the decision. HireFlow, the recruitment system and a Tier 3 vendor, returned the short questionnaire in a week and scored 84%. Its gaps were small: no single sign-on on Northbeam's plan and no independent assurance report. Rachel accepted the first until the plan upgrade at renewal and noted the second.
The honest comparison
| Free templates and typical advice | This kit | |
|---|---|---|
| Where you stand | A list of vendors with yes or no | A 0-4 self-assessment of 24 practices with a ranked gap plan |
| Tiering | Everyone gets the same review | Four factors and a criticality override, calculated, with the review each tier needs |
| Questionnaires | One long spreadsheet for every vendor | 20- and 60-question forms that score themselves, with knockouts |
| Decisions | An email saying 'approved' | Findings with owners and dates, residual risk by formula and acceptances that expire |
| Contracts | Whatever the vendor's paper says | A schedule starter for counsel and a coverage sheet that shows the weakest clauses |
| Compared with a consultant or software | A consultant brings judgement and hands-on time; software adds workflow and monitoring feeds | The method, files and decision rules in one place; works on its own or alongside either |
Made for you if…
- Procurement and security leads who have just been told 'you own vendor risk now'
- Companies whose bank, insurer or enterprise customer now asks for their third-party inventory and assessments
- Fintechs, payments and SaaS companies supplying regulated financial firms in Canada, the UK, the EU, Australia or the US
- Privacy officers who need processing terms and reviews in place for every processor
- IT and operations leads tired of a 300-row questionnaire nobody returns
- Suppliers who spend days answering customers' security questionnaires and want a trust pack
Probably not for you if…
- Anyone wanting legal advice: contracts and notification duties need your counsel
- Anyone wanting an audit, certification or a guarantee that reviewed vendors will not fail
- Large banks and insurers needing a full regulatory third-party risk framework or software integration
- Readers looking for an AI governance policy: see Bodhih's AI Use Policy and Governance Kit
Built by trainers, tested in real rooms.
Bodhih Training has designed and delivered corporate programmes since 2008. Bodhih Pro Kits package what works in those workshops into a guide plus the exact tools we use, so you can apply it the same day without a facilitator in the room.
From here to using it in three steps
- STEP 1
Tap Get the kit
Name, email and country. UPI, card or netbanking in India; international cards everywhere else. No account to create.
- STEP 2
Download instantly
Your download page opens at once, with every file and a one-click ZIP. A permanent link lands in your inbox too.
- STEP 3
Open the first tool
Start with the quick-start chapter, then the main spreadsheet or planner. Most buyers use something from the kit the same day.
Your third-party risk programme, in one place
Open the Start-here map and give it one hour. Whether you begin with the inventory tonight or the business case at your next leadership meeting, you will know what to do next and which file to open.
Personal licence for the buyer's own use, including use within your own company and with its staff. Please don't share or resell the files. Team, company and consultant licences: solutions@bodhih.com.
What buyers say
No ratings yet. Only people who have bought this kit can rate it - every buyer gets a one-click rating link a couple of days after their purchase.
The Bodhih family, when you are ready for more
The Ransomware and Cyber Incident Response Playbook
Prepare a small or mid-size organisation to respond to ransomware and other cyber incident.
The Psychosocial Risk Management Kit
Identify, assess and control psychosocial hazards at work as a health-and-safety duty, not.
The SME Sustainability Reporting Kit
Help a small or mid-size company answer customers', banks' and investors' sustainability q.
AssessAll
250+ AI-graded assessments to measure skills and earn verified credentials.
Jobulary
Individual development plans that start from evidence and stay yours.
Bodhih Training
Run this topic as a live workshop for your team, in person or online.
Pewple
Book a vetted coach for career, leadership or communication. Pay per session.
Bodhih.org pathways
Certification pathways in Applied AI, Workplace English and management.
The Third-Party and Vendor Security Risk Kit: FAQs
Read the free guideAlready bought? Resend my linkWhat is vendor risk management, in plain words?
It is how you choose, contract, watch and leave the suppliers that hold your data or run parts of your service, so the promises you make to customers still hold when someone else does the work. The kit covers every stage, from intake to exit.
Do I need a vendor risk programme if I am not a bank?
Usually yes, in some form. Privacy laws in most markets make you accountable for processors, and banks, insurers and large customers pass third-party duties down by contract. How much you need depends on your sector, size and customers; the kit scales by tier.
How long does it take to set up?
The e-book's sample company reached a running programme in twelve weeks, with every critical vendor reviewed. Your first hour gets your ten most important vendors scored; the roadmap and calendar turn the rest into dates.
Can I do vendor risk management without software or a consultant?
Many small and mid-size companies run it in a spreadsheet with a clear method. The kit gives you the method, files and decision rules. If you later buy software or hire help, the inventory, tiers and records carry straight across.
How many questions should a vendor security questionnaire have?
As few as the tier needs. The kit uses 20 questions for moderate-risk vendors and 60 for high and critical ones, with knockout questions that decide on their own whatever the score.
How do I read a vendor's SOC 2 report?
Check scope first, then the period, opinion, carved-out providers, the controls the report expects you to run (CUECs) and any testing exceptions. The kit's reading card and review record take about twenty minutes per report.
Is this legal advice, and will it make us compliant with DORA, GDPR or OSFI B-10?
No. The kit is educational and practical: templates are starting points for your counsel, and nothing guarantees compliance. Rules are paraphrased, and the dated sheet lists the official sources at November 2026 for you to check.
Does it work in my country?
The method works anywhere. The crosswalk and dated sheet cover the US, Canada, the UK, the EU, Australia and New Zealand, with a short note on India and the Gulf. Laws change, so check the official sources listed and your adviser.
Does it help when my customers assess us?
Yes. Chapter 10 and the message library cover the supplier side: a trust pack outline, a 25-answer bank and replies for questionnaires and financial-sector contract addenda.
Can I use this with my team?
Yes, within your own company under the personal licence: share the files with colleagues, run the 45-minute briefing and load the knowledge check into your LMS. Company-wide, multi-entity and consultant licences are available via solutions@bodhih.com.
How can I measure my team's vendor review skills?
AssessAll offers the Third-Party and Vendor Assurance Assessment for Procurement, Security and Risk Teams, the Data Governance and Data Quality Stewardship Judgment assessment and the Decision-Making Under Uncertainty assessment at assessall.com, useful alongside the kit's own knowledge check for procurement, security and risk staff.
How do I make the new habits stick after the first twelve weeks?
Write one if-then plan for each recurring step, such as 'if finance sends the new-supplier report, then I match it against intake numbers that afternoon'. Jobulary explains the method in its guide to if-then plans at work.
How much does The Third-Party and Vendor Security Risk Kit cost?
₹1,999 including 18% GST for buyers in India, or $49 for buyers outside India. One-time payment, no subscription, with an automatic invoice.
How do I get the files after paying?
Instantly. Your download page opens the moment payment succeeds, and a permanent download link is emailed to you. Download each file separately or everything in one ZIP.
What software do I need?
Any of the usual tools: Excel or Google Sheets for spreadsheets, Word or Google Docs for templates, Adobe Acrobat Reader, Preview, Xodo or GoodNotes for the fillable PDFs, and Google, Outlook or Apple Calendar for the calendar plan.
Can I get a refund?
Because it is a digital download, kits are not refundable once downloaded. We always refund a duplicate charge or a failed delivery, and if a file is corrupted and we cannot fix it within 3 working days. Full terms: bodhih.org/refunds.
Can my company buy this for a team?
Yes. Team and company licences, and workshops on this topic run by Bodhih Training, are available. Write to solutions@bodhih.com or call +91 99000 11601.
