Build and run a third-party / vendor risk management (TPRM) program aligned to NIST SP 800-161 C-SCRM and NIST CSF 2.0 GV.SC: inventory and tier vendors by risk, send the right due-diligence questionnaire (SIG, CAIQ), review evidence (SOC 2, ISO 27001, pen-test reports), set contractual security and right-to-audit clauses, monitor vendors continuously, manage Nth-party / subcontractor risk, and offboard securely.
SkillScore91Maintained
Automatic
◆Security & AppSec pack
Last verified 8/3/2026
What it changes
Passed 21 of 23 test cases with the skill, and 19 of 23 without it.
Without skill83%
With skill91%
Checks it passed that the model alone missed
The response requires invoking contractual breach notification terms.
The response requires escalating the refusal of audit rights to the business risk owner.
2 fixed19 passed either way2 still failing0 broke
Pass-rate lift
+9 pp
Tokens
+94%
Agent turns
0%
Response time
+16%
Model gemini-3.6-flashMeasured 8/3/2026v121 of 23 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 2
Prompt
A news outlet reports that a major file transfer vendor used by your company has suffered a zero-day exploit and breach. Explain the immediate steps the TPRM team must execute.
What was checked, without and with the skill
Checked
Without skill
With skill
The response instructs reviewing vendor record details to determine internal exposure.
Passed
Passed
The response requires invoking contractual breach notification terms.
Missed
Passed
case-13 · gemini-3.6-flash · 8/3/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md102 lines4 filesincludes scripts
Managing Third-Party Vendor Risk
When to Use
When assessing a new vendor before onboarding, especially one that will handle sensitive data, connect to your network, or be embedded in a critical process.
When standing up or maturing a third-party risk management (TPRM) program and you need a repeatable tiering + assessment workflow.
When tiering an existing vendor portfolio so effort matches risk.
When reviewing vendor evidence — a SOC 2 Type II report, ISO 27001 certificate, CAIQ, or pen-test summary — and you need to know what to look for.
When writing security and privacy requirements into a contract / DPA, including breach-notification SLAs and right-to-audit.
When a vendor (or their subcontractor) suffers a breach and you must assess exposure.
When managing software supply-chain and Nth-party (fourth-party and beyond) risk.
Prerequisites
A vendor inventory (who you use, for what, and what data/access each has).
A defined risk-tiering model (criteria and thresholds) agreed with the business.
Access to standardized questionnaires (Shared Assessments SIG, CSA CAIQ) and a way to collect evidence.
Clarity on your own regulatory obligations that flow down to vendors (e.g., HIPAA BAAs, CMMC flowdown, GDPR processor terms, PCI).
Stakeholders identified: procurement, legal, security, data owner, and the business sponsor.
Workflow
1. Inventory and classify vendors
Catalog every third party and capture: data sensitivity handled, type of access (network, physical, none), business criticality, and regulatory scope. You cannot manage what you have not inventoried — shadow vendors are a common blind spot.
2. Tier by inherent risk
Score each vendor on inherent-risk factors (data sensitivity, access, criticality, regulatory scope, spend/concentration) and assign a tier (e.g., Critical / High / Moderate / Low). The tier drives how deep the assessment goes and how often you reassess. A payroll processor with PII and system access is not the same risk as a stock-photo subscription.
3. Run tier-appropriate due diligence
Critical/High: full SIG (or SIG Core), request SOC 2 Type II and/or ISO 27001, recent pen-test summary, and evidence of an incident-response capability. Consider an assessor call.
SOC 2 Type II: check scope, the Trust Services Criteria covered, the audit period (not just the date), and especially the exceptions/deviations and any qualified opinion. A clean cover page can hide noted exceptions.
ISO 27001: confirm the scope statement and the Statement of Applicability actually cover the service you're buying.
CAIQ: look for "no" answers and CCM domains left blank.
Pen-test: age, scope, and whether highs/criticals were remediated.