Third-Party Technology and Cyber Risk Auditing Training Course

Course Introduction

The Third-Party Technology and Cyber Risk Auditing Training Course provides a comprehensive framework for evaluating technology and cybersecurity risks arising from vendors, suppliers, outsourced service providers, cloud platforms, managed service organisations, software providers, and other external technology relationships. Participants will develop practical capabilities to assess third-party governance, risk management, security controls, contractual safeguards, resilience arrangements, monitoring practices, and assurance evidence throughout the supplier lifecycle.

Organisations increasingly rely on external technology providers for critical infrastructure, software, data processing, payment services, cloud computing, cybersecurity, business applications, and operational support. While these relationships can improve efficiency and access to specialised capabilities, they can also introduce dependencies and risks involving data exposure, unauthorised access, service disruption, cyber incidents, compliance failures, concentration, and supply chain compromise. This course examines how auditors can identify and evaluate these risks systematically.

Participants will explore the complete third-party technology risk lifecycle, from supplier identification and classification through due diligence, onboarding, contracting, implementation, ongoing monitoring, incident management, performance evaluation, renewal, and exit. The programme examines how auditors can assess whether suppliers are appropriately risk-rated and whether critical technology relationships receive enhanced oversight based on data sensitivity, service criticality, connectivity, access privileges, geographic exposure, regulatory requirements, and business dependency.

The course provides detailed coverage of third-party cybersecurity controls, including identity and access management, encryption, vulnerability management, security monitoring, incident response, data protection, secure development, logging, backup, disaster recovery, and resilience. Participants will learn how to evaluate independent assurance reports, certifications, penetration-testing evidence, security questionnaires, audit rights, contractual commitments, and other forms of third-party assurance without treating external attestations as substitutes for risk-based audit judgement.

Particular attention is given to modern technology ecosystems involving cloud computing, software-as-a-service, application programming interfaces, fourth-party dependencies, artificial intelligence providers, remote access, managed security services, and interconnected digital platforms. Participants will examine how concentration risk, shared infrastructure, opaque subcontracting, continuous software updates, data transfers, and complex supply chains affect the audit approach. Data analytics and continuous monitoring techniques are also introduced to support more proactive third-party assurance.

By the end of the programme, participants will be equipped to plan, execute, document, and report third-party technology and cyber risk audits using a structured, risk-based approach. They will be able to evaluate supplier governance, cybersecurity controls, contractual protections, resilience, assurance evidence, incident readiness, concentration risks, remediation, and exit arrangements, while producing practical recommendations that strengthen oversight of critical external technology relationships and reduce exposure across the broader digital ecosystem.

Duration

10 days

Who Should Attend

• Internal auditors responsible for auditing third-party technology providers, suppliers, and outsourced services.

• IT auditors evaluating supplier cybersecurity controls, technology risks, cloud services, and external application environments.

• Cybersecurity professionals responsible for third-party security assessments, supplier assurance, and technology risk oversight.

• Third-party risk management professionals designing and monitoring technology supplier risk programmes.

• Vendor management professionals responsible for technology contracts, supplier performance, governance, and relationship oversight.

• Information security managers assessing external access, data protection, cyber controls, and supplier security risks.

• Procurement and contract management professionals involved in technology supplier selection and risk requirements.

• Risk and compliance professionals evaluating third-party operational, cyber, regulatory, and resilience risks.

• Cloud security professionals assessing cloud service providers, SaaS platforms, managed services, and shared-responsibility arrangements.

• Data protection and privacy professionals assessing external processing, information transfers, and supplier data-handling practices.

• Business continuity and resilience professionals evaluating supplier recovery capabilities and critical service dependencies.

• Audit managers and assurance leaders responsible for third-party technology risk reviews and assurance reporting.

• Technology managers responsible for outsourced infrastructure, applications, platforms, managed services, and strategic technology partnerships.

• Professionals seeking advanced practical expertise in auditing third-party technology and cybersecurity risk across complex digital supply chains.

Course Objectives

• Develop a comprehensive understanding of third-party technology risk, cyber supply chain exposure, supplier governance, and the auditor’s role in providing independent assurance.

• Apply risk-based methodologies to identify, classify, assess, and prioritise technology suppliers according to service criticality, data sensitivity, access privileges, and business dependency.

• Evaluate third-party governance frameworks, policies, accountability structures, risk ownership, oversight committees, escalation processes, and management reporting arrangements.

• Assess supplier due diligence procedures covering cybersecurity, financial stability, data protection, operational resilience, regulatory requirements, subcontracting, and technology dependencies.

• Evaluate technology contracts for security requirements, audit rights, breach notification, data protection, service levels, resilience, recovery, liability, and termination provisions.

• Assess third-party cybersecurity controls covering identity management, privileged access, encryption, vulnerability management, security monitoring, logging, and incident response.

• Examine cloud, SaaS, managed services, APIs, remote access, fourth-party relationships, and other technology ecosystems that increase external dependency and cyber exposure.

• Evaluate independent assurance reports, certifications, security assessments, penetration tests, questionnaires, control evidence, and other supplier assurance information using appropriate professional judgement.

• Apply data analytics and continuous monitoring techniques to identify supplier anomalies, control exceptions, performance deterioration, incidents, access risks, and emerging third-party threats.

• Assess third-party business continuity, disaster recovery, backup, service availability, incident response, resilience testing, and exit capabilities for critical technology services.

• Develop evidence-based audit findings, risk assessments, recommendations, management actions, and assurance reports that communicate third-party technology risks clearly.

• Strengthen continuous third-party assurance by integrating supplier risk intelligence, cybersecurity monitoring, contract compliance, performance metrics, incident information, and remediation tracking.

Comprehensive Course Outline

Module 1: Foundations of Third-Party Technology and Cyber Risk Auditing

• Principles, terminology, objectives, scope, and professional responsibilities associated with third-party technology and cyber risk auditing.

• Technology outsourcing models, supplier ecosystems, managed services, cloud providers, SaaS platforms, strategic partners, and external technology dependencies.

• Common third-party risks involving cybersecurity, data protection, service availability, operational disruption, compliance, concentration, and supply chain compromise.

• The auditor’s role in assessing external technology risk, control effectiveness, assurance evidence, management oversight, and residual exposure.

Module 2: Third-Party Technology Governance and Risk Management Frameworks

• Third-party governance structures, accountability models, risk ownership, management committees, supplier oversight, and escalation responsibilities.

• Policies, standards, procedures, risk appetite, supplier classification, control requirements, approval thresholds, and governance documentation.

• Integrating third-party cyber risk with enterprise risk management, information security, procurement, legal, compliance, business continuity, and internal audit.

• Evaluating management reporting, risk dashboards, governance metrics, exception management, oversight effectiveness, and continual programme improvement.

Module 3: Third-Party Risk Assessment and Audit Planning

• Identifying critical suppliers, technology dependencies, external connections, sensitive data relationships, privileged access, and business-critical services.

• Developing supplier risk classifications based on criticality, data sensitivity, connectivity, geographic exposure, regulatory requirements, and operational dependency.

• Designing risk-based third-party audit universes, engagement scopes, objectives, control matrices, evidence requirements, and testing strategies.

• Assessing inherent risk, control risk, residual risk, concentration exposure, fourth-party dependency, and potential business impact when prioritising audit work.

Module 4: Supplier Due Diligence and Technology Security Assessment

• Evaluating pre-contract due diligence covering cybersecurity maturity, security governance, financial viability, data handling, resilience, compliance, and operational capabilities.

• Assessing supplier security questionnaires, control assessments, certifications, independent reports, penetration testing, vulnerability information, and other assurance evidence.

• Auditing supplier onboarding processes, risk approvals, security requirements, control exceptions, remediation commitments, and documented acceptance of residual risk.

• Evaluating enhanced due diligence for critical providers, high-risk technologies, sensitive information processors, and suppliers with significant system access.

Module 5: Technology Contracts, Service Levels and Security Requirements

• Auditing technology contracts for cybersecurity requirements, confidentiality, data protection, access controls, incident notification, and regulatory responsibilities.

• Evaluating service-level agreements, availability commitments, recovery requirements, performance metrics, escalation mechanisms, and service credit arrangements.

• Assessing contractual audit rights, right-to-test provisions, evidence access, remediation requirements, subcontracting controls, and assurance reporting obligations.

• Reviewing termination, data return, secure deletion, portability, transition assistance, intellectual property, liability, and exit provisions for critical technology services.

Module 6: Third-Party Cybersecurity Controls and Access Management

• Evaluating supplier identity management, authentication, privileged access, remote access, service accounts, credential controls, and periodic access reviews.

• Auditing encryption, key management, secure configuration, endpoint security, network protection, vulnerability management, patching, and security monitoring controls.

• Assessing supplier logging, audit trails, security event monitoring, threat detection, alert management, and evidence retention supporting accountability.

• Evaluating controls governing supplier personnel, access termination, segregation of duties, subcontractor access, administrative privileges, and external connectivity.

Module 7: Cloud, SaaS and External Application Risk Auditing

• Auditing cloud service providers, SaaS applications, hosting environments, shared-responsibility models, and technology infrastructure delivered by external providers.

• Evaluating cloud configuration, identity controls, data protection, encryption, logging, resilience, backup, monitoring, and provider security responsibilities.

• Assessing APIs, integrations, application connections, data exchanges, mobile services, remote administration, and external interfaces that increase attack surfaces.

• Addressing multi-tenant environments, provider concentration, continuous releases, configuration ownership, portability, service dependencies, and cloud-specific assurance challenges.

Module 8: Data Protection, Privacy and Information Security in Third-Party Relationships

• Assessing supplier controls for collecting, processing, storing, transmitting, retaining, and securely disposing of organisational and personal information.

• Evaluating data classification, information-flow mapping, access restrictions, encryption, confidentiality, data minimisation, retention, and secure disposal requirements.

• Auditing cross-border data transfers, data residency, subcontracted processing, fourth-party access, cloud storage, and external information-sharing arrangements.

• Assessing privacy incidents, data breaches, supplier notification procedures, regulatory responsibilities, investigation support, remediation, and evidence preservation.

Module 9: Third-Party Incident Response, Business Continuity and Resilience

• Evaluating supplier incident response plans, notification procedures, escalation arrangements, investigation capabilities, evidence preservation, and recovery responsibilities.

• Auditing business continuity, disaster recovery, backup, redundancy, recovery objectives, alternate processing, and resilience controls maintained by critical technology suppliers.

• Assessing supplier participation in incident simulations, tabletop exercises, recovery tests, crisis exercises, and integrated organisational resilience testing.

• Evaluating lessons learned, corrective actions, repeated failures, recovery performance, resilience metrics, and management responses to supplier incidents.

Module 10: Fourth-Party, Supply Chain and Concentration Risk

• Identifying fourth-party relationships, subcontractors, technology dependencies, software components, infrastructure providers, and hidden supply chain exposures.

• Evaluating supplier transparency, subcontractor approval, flow-down security requirements, fourth-party monitoring, and contractual accountability.

• Assessing concentration risks involving dominant cloud providers, shared technology platforms, common service providers, geographic dependencies, and systemic external exposures.

• Developing audit approaches for software supply chains, managed service ecosystems, technology dependencies, critical infrastructure providers, and interconnected digital services.

Module 11: Third-Party Assurance Reports and Control Evidence

• Evaluating independent assurance reports, certifications, audit opinions, penetration tests, security assessments, control attestations, and supplier-generated evidence.

• Understanding the scope, period, control objectives, exceptions, complementary controls, limitations, and relevance of external assurance reports.

• Performing gap assessments between supplier assurance evidence and organisational control requirements, contractual commitments, risk appetite, and regulatory expectations.

• Determining when additional testing, direct evidence, management inquiry, technical assessment, or independent audit procedures are necessary.

Module 12: Third-Party Cyber Risk Data Analytics and Continuous Monitoring

• Applying analytics to supplier inventories, access records, incidents, security assessments, contract data, performance information, and risk-rating populations.

• Identifying anomalies involving supplier access, inactive relationships, overdue assessments, unresolved vulnerabilities, control exceptions, and unusual security events.

• Developing dashboards and continuous monitoring indicators covering supplier risk, assurance status, incidents, remediation, contract compliance, and service performance.

• Integrating threat intelligence, security monitoring, supplier information, risk systems, and automated alerts to strengthen ongoing third-party assurance.

Module 13: Technology Supply Chain Security and Emerging Cyber Risks

• Auditing software supply chain security, open-source dependencies, software bills of materials, code integrity, update mechanisms, and technology component risks.

• Evaluating risks associated with artificial intelligence providers, machine-learning services, automated platforms, external models, APIs, and emerging digital ecosystems.

• Assessing remote administration, managed security services, interconnected platforms, identity federation, automation, and other technologies that expand supplier attack surfaces.

• Addressing emerging threats involving supply chain compromise, malicious updates, credential abuse, dependency vulnerabilities, service concentration, and technology ecosystem disruption.

Module 14: Third-Party Performance, Risk Events and Remediation Management

• Evaluating supplier performance against service levels, cybersecurity requirements, control obligations, recovery objectives, contractual commitments, and agreed risk indicators.

• Auditing supplier incidents, control failures, security breaches, service disruptions, recurring exceptions, and management escalation processes.

• Applying root cause analysis to supplier weaknesses and developing remediation plans with accountable owners, deadlines, milestones, evidence requirements, and residual-risk assessments.

• Monitoring overdue remediation, validating corrective actions, reassessing supplier risk ratings, and escalating unresolved material weaknesses to appropriate governance bodies.

Module 15: Third-Party Technology Audit Reporting and Follow-Up

• Developing audit findings that connect control conditions, criteria, causes, consequences, supplier dependencies, cyber risks, evidence, and practical recommendations.

• Communicating third-party technology risks effectively to procurement, technology, cybersecurity, risk, legal, compliance, executive management, and governance committees.

• Preparing comprehensive assurance reports covering supplier governance, due diligence, contracts, cybersecurity, cloud services, resilience, fourth parties, and emerging risks.

• Conducting follow-up reviews, validating remediation evidence, reassessing residual risk, tracking overdue actions, and providing continuing assurance over critical suppliers.

Module 16: Advanced Third-Party Cyber Assurance Strategy

• Developing integrated third-party assurance strategies connecting supplier risk management, cybersecurity, procurement, contract management, business continuity, and internal audit.

• Evaluating continuous controls monitoring, automated supplier assessments, threat intelligence, external attack-surface intelligence, and technology-enabled assurance approaches.

• Assessing systemic digital ecosystem risks arising from cloud concentration, interconnected providers, AI services, software dependencies, geopolitical disruption, and critical technology suppliers.

• Designing future-focused third-party audit programmes that strengthen resilience, supplier accountability, risk transparency, control effectiveness, and sustainable cyber supply chain assurance.

Training Approach

This course will be delivered by our skilled trainers who have vast knowledge and experience as expert professionals in the fields. The course is taught in English and through a mix of theory, practical activities, group discussion and case studies. Course manuals and additional training materials will be provided to the participants upon completion of the training.

Tailor-Made Course

This course can also be tailor-made to meet organization requirement. For further inquiries, please contact us on: Email: training@upskilldevelopment.com Tel: +254 721 331 808

Training Venue 

The training will be held at our Upskill Training Centre. We also offer training for a group (at a discount of 10% to 50%) at requested location all over the world. The Onsite course fee covers the course tuition, training materials, two break refreshments, buffet lunch, airport transfers, Upskill gift package, and guided tour.

Visa application, travel expenses, dinners, accommodation, insurance, and other personal expenses are catered by the participant

Certification

Participants will be issued with Upskill certificate upon completion of this course.

Airport Pickup and Accommodation

Airport pickup and accommodation is arranged upon request. For booking contact our Training Coordinator through Email: training@upskilldevelopment.com, +254 721 331 808

Terms of Payment:

Unless otherwise agreed between the two parties’ payment of the course fee should be done 3 working days before commencement of the training so as to enable us to prepare better.