third-party-security
Assess and monitor third-party security risk — vendor diligence, contractual controls, ongoing oversight, and offboarding. Use when onboarding vendors with data or system access, or reviewing SaaS/supply security posture.
- License 许可
- MIT
- 最近更新
- 2026-07-22
- Stars
- ★ 7
- Forks
- 1
01 前言 Front Matter
- name
- third-party-security
- description
- Assess and monitor third-party security risk — vendor diligence, contractual controls, ongoing oversight, and offboarding. Use when onboarding vendors with data or system access, or reviewing SaaS/supply security posture.
03 SKILL.md 正文
Third-Party Security
Overview
Vendors extend your attack surface. Third-party security risk management evaluates and monitors those who process your data or connect to your systems.
When to Use
- Vendor security assessments and questionnaires
- SaaS and processor onboarding
- Contractual security schedule negotiation
- Periodic reassessment of critical vendors
Core Practices
- Tier vendors by data sensitivity and system criticality
- Perform proportionate diligence (questionnaires, SOC reports, testing rights)
- Require contractual security, incident notice, and audit rights as appropriate
- Limit vendor access to least privilege; monitor connections
- Reassess on cadence and on major incidents/changes
- Revoke access promptly at contract end
Principles
- A questionnaire is not continuous assurance
- Critical vendors need deeper oversight than long-tail tools
- Shared responsibility must be explicit in contracts and architecture
- Fourth parties (subprocessors) can inherit risk
Verification
- [ ] Critical vendors are tiered and assessed
- [ ] Contracts match risk tier requirements
- [ ] Access is reviewed and revoked on exit
04 同仓库更多 Skills
compliance-monitoring
Design compliance monitoring and testing programs that verify controls work in practice and surface issues before regulators do. Use when building monitoring plans, compliance testing, or continuous control monitoring.
complaints-handling
Operate complaints-handling processes that meet regulatory standards — logging, timely resolution, root-cause analysis, and fair outcomes. Use when designing or improving regulated complaints frameworks or analyzing complaint themes for conduct risk.
aml-kyc-basics
Apply AML/KYC fundamentals — customer due diligence, monitoring, suspicious activity escalation, and recordkeeping — for financial crime compliance. Use when designing onboarding controls, transaction monitoring concepts, or AML program components in financial services.
ai-model-compliance
Apply compliance controls to AI and automated decision systems — transparency, fairness, human oversight, documentation, and regulatory alignment. Use when deploying AI in regulated processes (credit, fraud, customer decisions) or responding to AI governance expectations.
data-quality-management
Manage data quality end-to-end — dimensions, rules, remediation, and prevention — beyond one-off cleaning scripts. Use when building sustained data quality programs or fixing systemic accuracy, completeness, or consistency problems.
data-lineage
Capture and use data lineage — where data comes from, how it transforms, and what depends on it — for impact analysis, debugging, and trust. Use when tracing metric origins, assessing change impact, or diagnosing broken pipelines.