Third-Party Risk Management Bootcamp
Become a Third-Party Risk Analyst.
Master the full third-party risk lifecycle (intake, inherent risk, vendor assessments, evidence review, decisions and monitoring) with a portfolio of real vendor work.
Choose how you learn
One bootcamp. Three ways to take it.
3Same role-based outcome. Pick the format that fits your life. Read it at your own pace with graded feedback, watch the video track, or join the live quarterly cohort.
Instructor-led
Watch the instructor teach on video: a guided track with self-checks, per-module interview prep and a hands-on lab.
Available now in the Fourth Tech Hub
Self-paced
Read the full course in the portal at your own pace: lessons, graded quizzes and assignments your instructor reviews.
Available now in the Fourth Tech Hub
Live cohort
Real-time sessions with the practitioner on a quarterly schedule: accountable, interactive, and capped for attention. We open these as cohorts are scheduled.
Next cohort · To be announced
Roles this prepares you for
- TPRM Analyst
- Vendor Risk Analyst
- Third-Party Risk Manager
- Supplier Risk Analyst
Standards & references
You'll build a portfolio of
- Inherent Risk Questionnaire
- Vendor Risk Assessment
- Vendor assessment summary
- Contract risk note
- Monitoring dashboard
The curriculum
The 8 modules
8Third-Party Risk Fundamentals
What TPRM is, why vendor risk matters, the vendor lifecycle and stakeholders.
Intake & Inherent Risk
Onboarding, data classification, criticality and Inherent Risk Questionnaire tiering.
Vendor Risk Assessment Methodology
Assessment scope, security domains, scoring logic and gap identification.
Reviewing Vendor Evidence
SOC 1/2 and ISO 27001 reviews, pentests, BCDR and incident-response maturity.
Risk Decisions & Business Alignment
Accept, mitigate or offboard; compensating controls and exception management.
Contracts, Clauses & Regulatory Alignment
Security clauses, audit rights, breach terms and subprocessor expectations.
Ongoing Monitoring & Portfolio
Reassessment cycles, external monitoring, KPIs and dashboards.
TPRM Job Readiness
Analyst vs manager work, interview questions and a capstone vendor assessment.
The challenge
Your worst outage will probably happen at a company you do not control
Organisations now run on suppliers, and the people asked to assess them are usually handed a spreadsheet and a deadline rather than a method.
Every vendor gets the same treatment
Without tiering, a payroll processor holding everything and a stock photo subscription receive the same questionnaire, so the real risk gets the same ten minutes as the trivial one.
Answers are collected, not checked
A completed questionnaire feels like assurance. It is a claim until somebody compares it against the SOC 2 or the ISO certificate and finds the scope does not cover the service you buy.
Nobody has looked past the first supplier
Your critical vendors share a handful of the same cloud regions and subprocessors. Concentration risk is invisible on a vendor-by-vendor review and is what actually takes you down.
The transformation
From chasing questionnaires to running a third-party risk programme
The lifecycle and the decision first, then the instrument most of the work is done with, then the resilience view that shows what a supplier failure would actually cost you.
Every vendor gets the same review
You tier on data, access and criticality, and spend the effort where the risk is
A SOC 2 report means the vendor is fine
You read the scope, the period and the exceptions, and say what it does not cover
The questionnaire is the deliverable
You validate answers against evidence and reach a recorded risk decision
Risk is accepted in a meeting and forgotten
You write it into the contract and monitor it for the life of the relationship
Your supplier list is a list
You can see fourth-party and concentration exposure across it
Continuity is a document nobody has tested
You run a business impact analysis and exercise the plan against it
Describes the capabilities this programme is designed to develop. Results vary with experience and effort. Completing a programme does not guarantee employment, promotion or acceptance by any employer.
The programme in numbers
What you actually receive
39
Hours of instruction
24
Modules
60
Lessons
24
Graded quizzes
6
Marked assignments
3
Courses included
Counted from the courses this enrolment grants, not written by hand, so they cannot drift from what you receive.
- Third-Party Risk Management Specialist — 8 modules, 13 hours
- Vendor Security Questionnaire Mastery — 8 modules, 13 hours
- Business Continuity & Disaster Recovery — 8 modules, 13 hours
Curriculum
What you will study, module by module
Phase 1: The vendor lifecycle and the risk decision
- 1.Why Third-Party Risk Matters and the Vendor Lifecycle1 hour
- 2.Intake, Tiering, and Due Diligence1h 30m
- 3.Reviewing SOC 2 and ISO 27001 Evidence1h 15m
- 4.Risk Decisions, Contracts, and Ongoing Monitoring1h 15m
- 5.Continuous Monitoring and External Risk Intelligence2 hours
- 6.Fourth-Party, Nth-Party, and Concentration Risk2 hours
- 7.Building and Running a TPRM Program2 hours
- 8.Regulatory Drivers for Third-Party Risk2 hours
Phase 2: The questionnaire, and what to do with the answers
- 9.The Standardized Questionnaire Landscape1h 15m
- 10.Designing a Right-Sized Questionnaire1h 15m
- 11.Completing and Analyzing Responses1h 15m
- 12.From Answers to Decisions, and Beating Fatigue1h 15m
- 13.Automation and Tooling for Questionnaires at Scale2 hours
- 14.SIG and CAIQ in Depth2 hours
- 15.Trust Packages and Shared Assessments2 hours
- 16.Validating Answers Against Evidence2 hours
Phase 3: Continuity, resilience and concentration risk
- 17.Foundations: Continuity, Recovery, and Response1h 30m
- 18.Recovery Targets and Strategies1h 30m
- 19.The Business Continuity Plan and Crisis Communication1 hour
- 20.Exercises, Testing, and Maintenance1 hour
- 21.Business Impact Analysis in Depth2 hours
- 22.Incident and Crisis Management2 hours
- 23.IT Disaster Recovery Architecture2 hours
- 24.Operational Resilience and Program Governance2 hours
Calendar
A plan that fits around work
Week 1
7 hours
- 1.Why Third-Party Risk Matters and the Vendor Lifecycle
- 2.Intake, Tiering, and Due Diligence
- 3.Reviewing SOC 2 and ISO 27001 Evidence
- 4.Risk Decisions, Contracts, and Ongoing Monitoring
- 5.Continuous Monitoring and External Risk Intelligence
Week 2
6 hours
- 6.Fourth-Party, Nth-Party, and Concentration Risk
- 7.Building and Running a TPRM Program
- 8.Regulatory Drivers for Third-Party Risk
Week 3
7 hours
- 9.The Standardized Questionnaire Landscape
- 10.Designing a Right-Sized Questionnaire
- 11.Completing and Analyzing Responses
- 12.From Answers to Decisions, and Beating Fatigue
- 13.Automation and Tooling for Questionnaires at Scale
Week 4
6 hours
- 14.SIG and CAIQ in Depth
- 15.Trust Packages and Shared Assessments
- 16.Validating Answers Against Evidence
Week 5
7 hours
- 17.Foundations: Continuity, Recovery, and Response
- 18.Recovery Targets and Strategies
- 19.The Business Continuity Plan and Crisis Communication
- 20.Exercises, Testing, and Maintenance
- 21.Business Impact Analysis in Depth
Week 6
6 hours
- 22.Incident and Crisis Management
- 23.IT Disaster Recovery Architecture
- 24.Operational Resilience and Program Governance
Total 39 hours across 24 modules. Hours are the time the material is built to take, not a cap: nothing stops you going slower or faster.
Fit
Is this programme for you?
This is for you if
- You assess vendors today and were never taught a method for it.
- You are moving into third-party risk from procurement, security, audit or compliance.
- You are the person a sales team comes to when a customer sends a security questionnaire.
- You will do the written work. A risk decision that is not written down did not happen.
This is not for you if
- You want a certificate for a CV line without doing the written work.
- You need an accredited or regulator-recognised qualification. This is a Fourth Tech certificate, not an accredited award, and we say so rather than implying otherwise.
- You want a specific GRC or TPRM platform certification. The programme is deliberately tool-agnostic so it survives a procurement decision.
- You need an assessment of your own suppliers. That is a service, not a course.
Outcomes
What you will be able to do
- Tier a supplier on data, access and criticality rather than on contract value
- Run intake and due diligence proportionate to the tier you assigned
- Read a SOC 2 or ISO 27001 report for scope, period and exceptions, and say what it leaves out
- Design a right-sized questionnaire and validate the answers against evidence
- Reach a defensible risk decision and carry it into the contract
- Map fourth-party and concentration exposure across the supplier base
- Run a business impact analysis and set recovery targets that mean something
- Exercise a continuity plan and report what the exercise actually proved
What you need
- No prior experience in the field. The programme starts from the vocabulary.
- A computer with a modern browser. The labs run in the browser, so no virtual machine and no particular operating system.
- Time for the written assignments. They are marked against a rubric, and skipping them removes the only thing that distinguishes you afterwards.
- No supplier data and no platform licence. Every exercise uses constructed vendors and reports.
Your path to the certificate
- 01
Enrol
Pay once and the programme opens in your portal immediately.
- 02
Work the phases
Each phase is a complete course in its own right, sequenced so the work compounds.
- 03
Submit the assignments
Each module has a quiz marked on our server and an assignment marked against a rubric.
- 04
Build the capstone
A single piece of work across the whole programme, which becomes your portfolio centrepiece.
- 05
Earn the certificate
Issued with a unique ID and a public verification page anyone can check.
Hands-on labs
You don't watch. You do.
6Next cohort · To be announced
Secure your seat for $2,000.
You're in as soon as you pay: the full program opens in your portal right away, to work through at your own pace. When a live cohort is scheduled you'll get its day-by-day plan and sessions as well, and cohorts are capped at 20 seats.