Core Configuration
About 13% of the CIS-TPRM exam — see all 7 domains.
Roles
- Third-party reader [vendor_reader]: read access to third-party contact records.
- Third-party editor [vendor_editor]: create, update, or delete third-party contact records.
- Third-party assessment reviewer [sn_vdr_risk_asmt.vendor_assessment_reviewer]: view assessment and questionnaire data and comment; contains vendor_reader. Minimum role to view TPRM templates.
- TPR assessor [sn_vdr_risk_asmt.vendor_assessor]: reviewer permissions plus manage third parties, contacts, external risk assessments, issues, and tasks; contains the reviewer role, vendor_editor, and vendor_reader.
- TPR approver [sn_vdr_risk_asmt.approver]: reviewer permissions plus approving IRQs and due diligence requests.
- TPR manager [sn_vdr_risk_asmt.vendor_risk_manager]: assessor permissions plus assessment templates, scheduled assessments, engagements and engagement contacts, and scoring rules.
- TPR admin [sn_vdr_risk_asmt.vendor_risk_admin]: manager permissions plus creating and editing assessment, risk tiering, risk tier questionnaire, questionnaire, and document request templates and post-assessment automation rules; configures TPRM properties.
- Contract risk negotiator [sn_vdr_risk_asmt.contract_negotiator]: assessor permissions plus the contract risk process.
- Third-party / engagement contact [vendor_contact]: external portal users.
Plugins / Store applications to activate
- Third-party Risk Management [com.sn_vdr_risk_asmt] (load demo data to get the sample questions)
- Due diligence request workflow (Third-party Risk Due Diligence) [com.sn_tprm_dd]
- Vendor Risk Management Workspace application [sn_vrm_ws], which provides the workspace users open as the Vendor Management Workspace
Other setup tasks: an authentication policy for external third parties, roles and groups, TPRM properties, the optional Risk concentration map (needs a Google license), email with third-party contacts, optional import of existing data, third-party contacts, and optional quick-start tests.
TPRM properties
Configured by the TPR admin at Third-party Risk Management > Administration > Properties: organization name shown in the portal, Excel delimiter and maximum file size, maximum age for reusing responses, whether assessors can answer or edit questionnaires for contacts (sn_svdp.allow_assessor_edit, classic only), and Smart Assessment Engine enabled (irreversible).
Sample questions from this domain
Three of the 39 in this domain, with the reasoning. The full set is in the question bank.
Which activity is part of the initial core configuration of a Third-party Risk Management (TPRM) implementation?
- A. Activating the Third-party Risk Management store applications and assigning TPRM roles ✓
- B. Creating a custom third-party table, because TPRM does not store third parties in Company
- C. Turning on the Smart Assessment Engine property, knowing it can be reverted after testing
- D. Building a new Service Portal site for contacts, since TPRM ships no contact portal
Why: The TPRM setup checklist starts with activating the Third-party Risk Management [com.sn_vdr_risk_asmt], Due diligence request workflow [com.sn_tprm_dd], and workspace [sn_vrm_ws] applications from the ServiceNow Store, then assigning TPRM roles to users and groups. Third parties are Company [core_company] records categorized as Vendors, so no custom table is needed; the Smart Assessment Engine enabled property cannot be reversed once set to true; and TPRM already provides the Third-party portal (/svdp) for contacts.
Which TPRM role is typically granted to internal staff who create and manage third parties and assessments but are not system administrators?
- A. A read-only role such as Third-party reader (vendor_reader) or Third-party assessment reviewer (sn_vdr_risk_asmt.vendor_assessment_reviewer)
- B. An external role such as Third-party contact (vendor_contact), which contains snc_external and grants access to the Third-party portal
- C. A TPRM functional role such as TPR manager (sn_vdr_risk_asmt.vendor_risk_manager) or TPR assessor (sn_vdr_risk_asmt.vendor_assessor) ✓
- D. A support role such as TPR approver (sn_vdr_risk_asmt.approver) or TPR internal task responder (sn_vdr_risk_asmt_internal_task_responder)
Why: Functional TPRM roles such as TPR assessor (manage third parties, third-party contacts, external assessments, and issues) and TPR manager (adds assessment templates, scheduled assessments, engagements, and scoring rules) let internal staff do this work without full platform admin rights. Third-party reader only reads contact records and the assessment reviewer views assessment data and can comment but cannot manage third parties or assessments; vendor_contact is for external contacts and grants only portal access; TPR approver adds IRQ approval to reviewer rights, and the internal task responder works only the internal tasks assigned to them.
When configuring third-party and engagement tiers, what should the tier definitions be aligned to?
- A. The organization's criticality/risk criteria so tier assignment reflects the third party's importance ✓
- B. The annual spend with each third party alone, so tier assignment reflects only the size of the contract
- C. The latest risk intelligence provider score, so tier assignment follows the external provider's rating
- D. The number of questionnaires in each assessment template, so tier assignment reflects review effort
Why: Tier definitions should map to the organization's criticality/risk criteria so a third party's or engagement's tier reflects its importance and risk; in TPRM, internal assessments (such as the inherent risk questionnaire) calculate these tiers. Spend alone ignores data access, service criticality, and other inherent risk factors; a risk intelligence score is an outside view that feeds scoring as a component, not the inherent tier; and questionnaire count is a result of the tier, not a basis for it.