Third-party risk: start from a defensible draft.

Connect service, dependency, data, access, substitutability, fourth parties and criticality.

Typical owner: TPRM & Vendor Owner · Based on: ISO, KaitoSec

Risk-based core questions on governance, access, operations, development, incidents, BCM and the supply chain.

Typical owner: Information Security · Based on: UP KRITIS / BSI, ISO, KaitoSec

Manage required evidence with scope, validity, assessment result, owner and expiry date.

Typical owner: Assurance · Based on: ISO, KaitoSec

Document scenario, impact, control gap, treatment, residual risk and approval per relationship.

Typical owner: Risk Owner · Based on: EU, ISO, KaitoSec

Bundle evidence, SLAs, incidents, changes, measures and new risk signals into one decision.

Typical owner: Vendor Owner · Based on: ISO, KaitoSec

Prepare triggers, substitution, data return, access termination, deletion, knowledge transfer and closure.

Typical owner: Service & Vendor Owner · Based on: ISO, BSI, KaitoSec