Other Application Relationships
About 5% of the CIS-TPRM exam — see all 7 domains.
Governance, Risk, and Compliance (GRC / IRM)
TPRM is one of ServiceNow's Governance, Risk, and Compliance products (marketed as Integrated Risk Management). Its engagements relate to the shared Risk [sn_risk_risk] and Control [sn_compliance_control] records.
- Policy and Compliance Management: compliance managers associate control objectives and controls with third parties, engagements, and classic questionnaire questions; incorrect answers mark the linked controls non-compliant (SAE uses post-assessment actions instead). All third parties are categorized into an entity type called Vendors. TPRM consumes compliance objects read-only.
- Risk Management: risks and risk statements can be associated with third parties and engagements, influencing their risk posture and scoring.
CMDB
Third parties and engagements can be associated with business services in the Service [cmdb_ci_service] table, and in classic scoring the business service criticality weight is factored into the score.
Continuous monitoring: risk intelligence providers
Register a provider, set up its services and how their scores map to TPRM ratings, and add scores to third parties (risk data is requested for third parties, not engagements). ServiceNow-supported integrations: Shared Assessments (SIG content) and EcoVadis (sustainability ratings). Partner integrations include BitSight, SecurityScorecard, RiskRecon, UpGuard, Recorded Future (cyber), Black Kite, Interos (supply chain and multiple domains), TruSight, and ISS Corporate Solutions. If a provider is not listed, no packaged integration exists; you can build one with Integration Hub.
Sample questions from this domain
Three of the 15 in this domain, with the reasoning. The full set is in the question bank.
How does Third-party Risk Management (TPRM) commonly relate to Policy and Compliance Management?
- A. Smart Assessment Engine questions map directly to control objectives, while classic questions flag controls only through post-assessment actions
- B. Questionnaire questions can be linked to control objectives, so third-party responses update the compliance status of related controls ✓
- C. Questionnaire questions can be linked to risk statements, so third-party responses recalculate the residual risk of the related enterprise risks
- D. Policy statements are attached to engagements, so each third-party contact attests to the linked policies from the Third-party portal
Why: With Policy and Compliance Management installed, compliance managers link questionnaire questions (and third parties and engagements) to control objectives, and an incorrect answer marks the linked controls non-compliant. The engine roles are reversed in the Smart Assessment Engine option: SAE questions cannot map directly to control objectives and use post-assessment actions instead. Linking questions to risk statements describes the Risk Management integration, which works through risks associated with third parties and engagements, not Policy and Compliance. Third-party contacts do not attest to policies in the Third-party portal; controls and control objectives are authored in Policy and Compliance and consumed read-only by TPRM.
How can Third-party Risk Management (TPRM) leverage the CMDB?
- A. By storing engagements as configuration items, so CMDB relationship maps replace the engagement hierarchy
- B. By linking third parties to discovered applications, so each Discovery scan refreshes their risk rating automatically
- C. By associating third parties and engagements with the business services they support, adding business context to risk ✓
- D. By using CMDB support group members as third-party contacts, so questionnaires route to service owners
Why: Third parties and engagements can be associated with one or more business services from the Service [cmdb_ci_service] table, and in classic scoring the business service criticality weight is factored into the risk score. Engagements are TPRM records, not configuration items, and CMDB relationship maps do not replace them. Discovery results do not refresh third-party risk ratings; ratings come from assessments and risk intelligence scores. Third-party contacts are people at the third party, not internal CMDB support group members.
A chief risk officer wants third-party exposure to be weighed next to other enterprise risks in the risk register. With Risk Management installed alongside Third-party Risk Management (TPRM), what makes this possible?
- A. Third-party risk issues are converted into enterprise risks automatically once they are closed
- B. Risk Management sends its own risk assessments to third-party contacts through the Third-party portal
- C. Third-party risks can be associated with enterprise risks and considered alongside them for unified governance ✓
- D. Risk statements are copied into questionnaire templates, so third parties rate the related enterprise risks directly
Why: With both applications installed, third parties and engagements can be represented as entities in Risk Management and risks and risk statements can be associated with them, so third-party risk is considered alongside enterprise risk. Third-party risk issues are remediation records and are not converted into enterprise risks when they close. Third-party contacts respond to TPRM questionnaires in the Third-party portal, not to Risk Management assessments. Risk statements are associated with third parties and engagements, not copied into questionnaire templates for third parties to rate.