Third-Party Risk Management (TPRM)
Master the end-to-end vendor risk lifecycle to protect organizational supply chains from catastrophic data breaches. Learn how to design vetting questionnaires, evaluate SOC reports, audit third-party security postures, and build automated continuous monitoring workflows.
What you will be able to do
The skills employers screen for in TPRM roles, practised through live case work rather than slides.
Curriculum
Delivered across live sessions. The depth of each module scales with the plan you choose.
1The third-party risk lifecycle
- Planning, due diligence, contracting and onboarding
- Monitoring and offboarding
- Who owns each step
2Vendor inventory and risk tiering
- Inherent risk drivers: data, criticality, connectivity
- Building a tiering matrix
- Residual risk after controls
3Due diligence questionnaires
- SIG and SIG Lite structure
- CAIQ for cloud providers
- Reading answers critically and following up
4Reading assurance reports
- SOC 1 versus SOC 2, Type I versus Type II
- Exceptions, bridge letters and CUECs
- Checking certificate scope
5Contracts and security clauses
- Right to audit and breach notification terms
- Data protection and subprocessor clauses
- Security SLAs that can be enforced
6Continuous monitoring and issues
- Security ratings and re-assessment cadence
- Remediation tracking
- Supply chain views from NIST SP 800-161 and ISO 27036
7TPRM platforms
- How OneTrust TPRM and Prevalent run assessments at scale
8Capstone and interview preparation
- Tier a vendor portfolio and review a real SaaS vendor
- Write an assessment report for executive sign-off
Frameworks and tools you will use
The standards and platforms named in real job descriptions for this field.
Your portfolio deliverable
Build an enterprise Vendor Risk Tiering Matrix, execute a complete SIG Lite vendor review on a real SaaS vendor, and author a Third-Party Risk Assessment Report for executive sign-off.
Where this track leads
Roles our TPRM learners prepare for, with median salaries in the US and UK.
TPRM / Vendor Risk Analyst
Most common first role from this track
$90,000 / £60,000
Supply Chain Risk Manager
Also within reach
$115,000 / £78,000
Third-Party Governance Specialist
Also within reach
$120,000 / £82,000
Salary figures are indicative US and UK medians and vary by city, employer and experience.
Who this track is for
Questions about the TPRM track
Do I need a technical background for the TPRM track?
No. A basic understanding of how businesses buy software and services helps, and the first module covers the vocabulary you need.
Is the training live or recorded?
Live. Every session is taught online by a practitioner in real time, with time for questions and case work. There are no pre-recorded lectures.
How many hours of training do I get?
That depends on the plan you choose: Node is 10 hours, Lattice is 20 hours and Nexus is 35 hours. Nexus also includes all six tracks.
What will I have built by the end?
Build an enterprise Vendor Risk Tiering Matrix, execute a complete SIG Lite vendor review on a real SaaS vendor, and author a Third-Party Risk Assessment Report for executive sign-off.
Do you help with finding a job?
Yes. Lattice and Nexus include ATS-friendly resume rebuilding, LinkedIn profile updates, a mock interview and ongoing career mentorship. Nexus adds 1-on-1 executive coaching and priority placement support.
Is a certification exam included?
You receive an OMNyra certificate of completion. External certification exams and their fees are not included. If you plan to sit CTPRP, ask on your free call how this track maps to it.
Is there a discount for groups?
Yes. Friends or colleagues enrolling together as a group of 3 or more get group pricing, and organisations can book a dedicated cohort with custom scheduling.
Pair it with another track
Not sure TPRM is the right fit?
Book a free 1-on-1 call. We will look at your background and target market, then recommend a track and plan.