TPM-01—Third-Party Assurance Review

1. Inspect Organization Procurement Policy and Vendor Information Security Standard to determine whether requirements for third-party assurance reviews are defined. 2. Observe Organization Risk Assessment system to determine whether a questionnaire for systematically assessing third-party risks is defined. 3. For a sample of vendors, inspect whether the corresponding Vendor Security Review (VSR) is completed to determine whether management has assessed the third party's controls to determine Organization requirements are met and management took action on control gaps as applicable.