vendor-risk-management

Assessors Studio operationalizes CycloneDX Attestations (CDXA): perform assessments, collect evidence, make claims, and issue machine-readable CycloneDX attestations, optionally legally binding for B2B and B2G use cases.

LT-VRM — a free & open-source Third-Party Risk Management (TPRM) / Vendor Risk Management platform: vendor risk assessments, security questionnaires, 0–1000 risk scoring & ratings, contract management, breach & dark-web monitoring, and a vendor portal. Self-hosted on stock XAMPP (PHP + MySQL). Free for the community by LearnTPRM.com.

A complete third-party vendor security risk-assessment framework — questionnaire, live scoring engine, and worked vendor assessments with approve/conditions/reject recommendations. Two-axis inherent×control residual-risk model mapped to NIST 800-161, ISO 27001 & SOC 2.

AI Governance portfolio case study assessing a high-risk automated loan underwriting system using VerifyWise, EU AI Act, NIST AI RMF, and ISO/IEC 42001 concepts.

Transforming vendor risk management post-breach: from failed checklists to evidence-based assurance.

Top Third Party Risk Management 🌟 Star if you like it! 🌟

Turn a vendor security questionnaire spreadsheet into a first-pass draft, citing your own security docs for every answer and never inventing a control you do not have.

AI Governance portfolio case study assessing a high-risk automated loan underwriting system using VerifyWise, EU AI Act, NIST AI RMF, and ISO/IEC 42001 concepts.

Top Third Party Risk Exchange 🌟 Star if you like it! 🌟

AI Governance Portfolio for an Automated Loan Underwriting System

AI-native Third-Party Risk Management platform — automate vendor security questionnaires, evidence review, and continuous monitoring with policy-as-code.

Turns vendor security documentation into a preliminary third-party AI risk assessment — cited evidence, deterministic risk scoring, and NIST AI RMF mapping, with prompt-injection screening on untrusted vendor PDFs.

cans one or more URLs for content categorization using the WhoisXML Website Categorization API.

Five Claude Skills for SaaS compliance workflows: security questionnaires, SOC 2 readiness, vendor risk, audit evidence, and trust page audits. Contract-validated in CI.

Evidence-linked vendor risk assessment and human-reviewed renewal briefs. Offline OSS reference with synthetic evaluation.

Simulated healthcare third-party risk assessment covering HIPAA due diligence, findings, corrective actions, and conditional vendor approval.

Standardized diligence for third-party AI systems: vendor intake, test battery (red-team + fairness + lineage), risk score, and go/no-go written into the model governance registry

Seven GRC artifacts — risk register, SOC 2 readiness walkthrough, vendor risk assessment, NIST CSF 2.0 ↔ ISO 27001 ↔ SOC 2 crosswalk, policy set, and a program self-assessment report — built against a real client engagement, with 94 citations checked against primary sources.

AI-powered vendor security review workspace with evidence-linked findings, grounded RAG Q&A, human approval, and executable evaluations.

Three-part AI vendor governance pack: due diligence questionnaire, SOW/operational requirements, and contract clause checklist — covers NIST AI RMF, ISO 42001, cybersecurity, forensics, and agentic AI controls