Module 10 · Vendor Risk Management Programme

Manish Garg
Manish Garg Associate of (ISC)² · RingSafe
Apr 27, 2026
1 min read
Read as

Last updated: April 29, 2026

100% Free

No signup. No paywall. No catch. One of our 10 most-requested practitioner modules — published in full so anyone can learn for free. We earn through consulting, not by gating knowledge.

See all 10 free modules →

Module 7 (DPDP track) covered DPA-specific. This is the broader vendor-risk programme.

Module 7 (DPDP track) covered DPA-specific. This is the broader vendor-risk programme.

Programme components

  1. Vendor classification (tier 1/2/3 by data sensitivity, criticality)
  2. Onboarding due diligence (questionnaire, contracts, SOC 2/ISO collection)
  3. Continuous monitoring
  4. Periodic reassessment (annual for tier 1; biannual for tier 2)
  5. Offboarding (data return / deletion)
Want this for your team?

Custom team training + practitioner advisory

Beyond the free academy — we run private workshops, vCISO advisory, and red-team exercises tailored to your stack. For Indian SMBs scaling past their first hire.

Book team training call Replies in 4 working hrs · India-only · Senior consultants
← Previous · Module 9
Module 9 · Enterprise Risk Register
← Back to Academy Hub
Continue Learning

Other modules in this track

View all modules
Academy
Module 1 · Beginner

Governance, risk, compliance — the operating loop, frameworks, board reporting, common program failures.

Apr 22, 2026 · 5 min read
Academy
Module 2 · Intermediate

Required documents, the SoA, 2022 control structure, implementation timeline, common gaps for Indian implementations.

Apr 22, 2026 · 4 min read
Academy
Module 3 · Intermediate

Type 1 vs 2, Trust Services Criteria, audit lifecycle, critical controls, choosing an auditor, India-specific gotchas.

Apr 22, 2026 · 5 min read