TPRM Program - SCF CORE Fundamentals

ComplianceForge decided to make the Third-Party Risk Management Program (TPRM) Program Template because it is a crucial step in the risk management process for many organizations. For a limited period of time, ComplianceForge is offering its TPRM Program template at no-cost to select organizations. This is a $1,200 value.

Why Did ComplianceForge Make The Third-Party Risk Management (TPRM) Program?

There is an increasing amount of hype associated with TPRM with little to no information on how to actually create a TPRM program, where that hype tends to be focused on automating a questionnaire in many cases. The reality is that automation only makes bad processes faster! Noticing this need, ComplianceForge created a TPRM Program Template that offers clear guidance your organization can follow throughout the entirety of its TPRM program and processes. It includes two key TPRM components:

  1. TPRM program template; and
  2. TPRM risk assessment questionnaire.

In other words, ComplianceForge’s TPRM Program offers the entire pie for TPRM, rather than a single piece. For those who sell or provide TPRM questionnaires (manual or automated), they often sell what is equivalent to a piece of the pie, rather than providing the entire pie.

That pie concept is the broader concept of risk management, where Supply Chain Risk Management (SCRM) / Third-Party Risk Management (TPRM) are subsets of your organization's overall risk management program. This is where policies, standards and procedures that govern risk management support the ability to implement downstream requirements like TPRM risk questionnaires. 

View TPRM Program Template Examples

If you would like to view examples of ComplianceForge's Third-Party Risk Management (TPRM) Program, please click the image below:

TPRM - Word Example
TPRM Program

  

TPRM - Excel Example
TPRM Questionnaire

Why Is ComplianceForge Giving The TPRM Away For Free To Those Who Request It?

The TPRM Program template offer is a gesture of good faith because ComplianceForge’s mission is to help companies succeed and become secure, compliant & resilient. Like everything else ComplianceForge has developed, the TPRM Program is written with care, filled with comprehensive material and is designed to help organization hit the ground running with their TPRM efforts.

To celebrate the launch of the TPRM Program, ComplianceForge is making it available at no cost for those who request it for a limited time.  This isn’t a sample or a watered-down version — it’s the full experience, because we’d rather let the product speak for itself. 

This version of ComplianceForge’s TPRM Program utilizes the Secure Control Framework’s (SCF) CORE Fundamentals, which is comprised of a tailored set of 68 controls within the SCF that are specifically designed for smaller organizations to protect People, Processes, Technologies, Data and Facilities (PPTDF) against common threats. The SCF’s CORE Fundamentals were created in response to the passing of the Texas SB 2610, which listed the SCF as one of a select few cybersecurity frameworks with adequacy to provide necessary security coverage.

SCF CORE Fundamentals

These controls nest within the NIST Cybersecurity Framework (CSF) and meet many of its requirements, so it can be an excellent starting point towards a path of determining a third-party’s maturity towards NIST CSF 2.0 alignment. In other words, this version of the TPRM Program is equivalent to being the Goldilocks TPRM, since it is just right for most organizations, not too complex nor too plain.

SCF CORE Fundamentals Roadmap

What Is ComplianceForge’s Approach?

ComplianceForge’s approach towards TPRM is to operationalize sustainable and reasonable practices for organizations to follow. ComplianceForge’s TPRM Program is 100% scalable and allows for additional controls to be added based on the organization's requirements.

ComplianceForge brought together content, processes, and technology:

  • The SCF CORE Fundamentals is the content;
  • The TPRM Program template is the process;
  • SCF Connect and other GRC tools that want to participate are the technology, since they have the functionality to efficiently operationalize TPRM practices.

Additionally, ComplianceForge’s TPRM Program can be certified against by a third party through the Secure Controls Framework Conformity Assessment Program (SCF CAP), which is an organization-level conformity assessment. Regardless of the industry, there is a definitive need for a third-party verified certification that assesses tailored cybersecurity and privacy controls that could impact the organization and its supply chain stakeholders.

!