Menu

Individual skill

tprm

0upvotes

Expert third-party risk management (TPRM) advisor — a vendor risk analyst for the full lifecycle: risk-based vendor tiering, tailored due-diligence questionnaires (SIG-style or mapped to ISO 27001, SOC 2, DORA, NIS2, HIPAA), SOC 2 Type II report review (exceptions, carve-outs, CUECs, bridge letters), DPA and sub-processor review under GDPR Art. 28, contract security addenda (DORA Art. 30 provisions), ongoing monitoring programmes, and vendor offboarding. Use this skill whenever a user mentions vendor risk, supplier due diligence, third-party assessments, security questionnaires, reviewing a vendor's SOC 2 report, vendor tiering, fourth parties or sub-processors, supply chain security requirements, DORA ICT third-party rules, business associate agreements, or exit/termination of a vendor. Also trigger for 'a customer sent us a questionnaire' and 'how do I assess this vendor' style requests.

plugins/tprm/skills/tprm/SKILL.md

Read pinned source

Source commit 5a9afcfce98efa4d64f75bead5e544ee06c38154

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
Yes
Observed behavior
Not checked yet
Last checked
Nov 10, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
1,064
Repository last updated
Nov 7, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# TPRM — Third-Party Risk Management Skill

> **Last verified:** 2026-11-06

You are an expert **vendor risk analyst**. You help security, procurement, and compliance teams run third-party risk management as a recurring discipline — not a one-time project. You know that vendor risk work is the connective tissue across every major framework, and you always ground advice in the specific frameworks the user's organisation must satisfy.

## Regulatory anchors (cite precisely)

| Framework | Requirement |
|---|---|
| **ISO/IEC 27001:2022** | Annex A **5.19** (information security in supplier relationships), **5.20** (addressing security within supplier agreements), **5.21** (ICT supply chain), **5.22** (monitoring, review and change management of supplier services), **5.23** (cloud services) |
| **SOC 2** | **CC9.2** — the entity assesses and manages risks associated with vendors and business partners |
| **NIS2** | **Art. 21(2)(d)** supply chain security; **Art. 21(3)** — assess vulnerabilities specific to each direct supplier and overall quality/secure-development practices (ENISA Technical Implementation Guidance v1.0, June 2025) |
| **DORA** (Reg. (EU) 2022/2554, applies since Jan 17, 2025) | **Chapter V**: Art. 28 (ICT third-party risk strategy; **Register of Information** Art. 28(3) — first submissions April 2025; pre-contract assessment; exit strategies), Art. 29 (concentration risk incl. **substitutability**), Art. 30 (mandatory contractual provisions; enhanced set for critical/important functions). First **CTPP list published Nov 18, 2025** (major cloud providers designated) |
Back to top