GRC Master Cheat Sheet

TPRM + Cloud Vendor Key Controls

Third-Party Risk Management (TPRM) – Continuous Monitoring

Key Pointers

Area Key Pointer Why It Matters
Vendor Inventory Centralized vendor register Single source of truth for all vendors + risk tiering.
Risk Tiering Risk-based classification High-risk vendors get deeper controls + continuous monitoring.
Due Diligence Automated evidence collection Reduces manual questionnaires; API-based checks improve accuracy.
Continuous Monitoring External threat monitoring Detects breaches, leaked credentials, vulnerabilities in real time.
Contract Management Security clauses + SLAs Ensures vendors are legally bound to controls + reporting timelines.
Control Validation Ongoing control testing Ensures controls remain effective beyond onboarding.
Issue Management Risk remediation tracking Ensures findings are fixed with deadlines + accountability.
Offboarding Secure vendor termination Ensures access removal + data return/destruction.
Reporting Executive dashboards Shows risk posture, trends, and vendor performance.

TPRM Lifecycle Steps

1. Vendor Intake & Classification
Identify vendor, collect basic info, assign risk tier.
2. Due Diligence
Automated questionnaires, SOC2/ISO review, cloud posture checks.
3. Risk Assessment
Evaluate security, privacy, financial, operational, and compliance risks.
4. Contracting
Include SLAs, breach notification timelines, data handling clauses.
5. Continuous Monitoring
Threat intel, attack surface monitoring, leaked credentials, CSPM signals.
6. Issue Management
Track findings, remediation deadlines, and vendor accountability.
7. Reporting & Dashboards
Provide leadership visibility into vendor risk posture.
8. Offboarding
Terminate access, ensure data return/destruction, update inventory.

Cloud Vendor Key Controls

Control Area Key Control Why It Matters
Identity & Access MFA enforcement Prevents credential theft and unauthorized access.
Least Privilege Role-based access (RBAC) Ensures vendors only access what they must.
Data Protection Encryption at rest & transit Protects sensitive data from exposure.
Logging & Monitoring Cloud audit logs enabled Ensures traceability and incident investigation.
Network Security Firewall & security groups Blocks unauthorized inbound/outbound traffic.
Vulnerability Management Regular scanning + patching Reduces exploitable weaknesses.
Backup & Recovery Automated backups + retention Ensures resilience and data recovery.
Compliance Evidence SOC2/ISO certifications Validates vendor’s security posture.
Incident Response Breach notification SLAs Ensures timely reporting and containment.
Configuration Hardening CIS benchmark alignment Ensures secure baseline configurations.
Data Residency Region restrictions Ensures compliance with GDPR/HIPAA.
Third-Party Dependencies Sub-processor transparency Ensures vendor’s vendors are also secure.

Short Checklist (Quick Recall)

MFA enabled for all admin accounts
Encryption for buckets/blobs/databases
No public exposure unless justified
CSPM alerts (AWS Config, Azure Policy, GCP SCC)
Audit logs enabled (CloudTrail, Activity Logs)
Key rotation enforced
Patch compliance monitored
Backups + retention validated
SOC2/ISO certs reviewed
Breach notification SLA in contract
Data residency confirmed
Sub-processor list reviewed