Third-Party Risk Assessment overview

Assesses risk exposure from third-party vendors, partners, and service providers -- distributing security questionnaires and evaluating responses against organizational standards, reviewing SOC 2 and ISO 27001 attestation reports for control coverage, assessing data-handling practices and sub-processor chains for GDPR compliance, evaluating business-continuity and disaster-recovery capabilities, scoring vendors on a composite risk matrix incorporating financial stability, concentration risk, and geopolitical factors, and defining residual-risk acceptance or mitigation requirements. Produces third-party risk assessment report and risk-tier classification. Excludes contract negotiation.