Vendor Portal Configuration
About 15% of the CIS-TPRM exam — see all 7 domains.
The Third-party portal
The Third-party portal (formerly the Vendor Portal) is the point of interaction between third parties and risk assessors. Third-party contacts open it at [instance URL]/svdp to respond to questionnaires, document requests, tasks, and issues, upload documents, and manage their team. The portal is fully isolated from the internal instance. Issues and tasks appear there only when Visible in third-party portal is selected.
External user access and roles
Third-party contacts are external users. Each is automatically assigned:
vendor_contact: grants access to the Third-party portal (it contains snc_external).snc_external: restricts the user to the portal only.
With SAE, contacts also receive sn_vdr_risk_asmt.external_assessment_responder to answer external questionnaires. Give the third-party contact role only to external users; a contact who also holds snc_internal could reach the platform.
Contacts and the primary contact
Each third party must have at least one primary contact. There are four contact role types: third-party primary, third-party secondary, engagement primary, and engagement secondary. An engagement needs an engagement primary contact before engagement-level questionnaires can be sent. Primary contacts invite contacts, assign contacts to engagements, delegate work, and deactivate contacts.
How questionnaires are assigned depends on the engine:
- Classic: the questionnaire goes to a single primary contact (alphabetical order), who completes and submits it.
- SAE: all primary contacts are assigned; one (alphabetical by last name) is the questionnaire owner, the others are contributors; only the owner submits or reassigns ownership, and the owner can add secondary contacts as contributors.
Internally, a TPR manager (with an admin for some steps) creates the third-party contact record (User ID, third party, Active, Primary contact); submitting it emails the contact the portal link and login credentials. From the contact record you can Resend Invite, lock out, deactivate, set a password, or reset a password.
Responding to assessments
Contacts answer in the portal (responses save automatically), use the Excel template (download, complete offline, import the .xlsx), or use the SIG format. In the classic engine, items that require an e-signature are signed with Save and Sign (typed or drawn); the signature feature is not supported for SAE questionnaires. The organization name shown in the portal comes from the TPRM property sn_vdr_risk_asmt.company.name.
Sample questions from this domain
Three of the 44 in this domain, with the reasoning. The full set is in the question bank.
What is the primary purpose of the Third-party portal (formerly the Vendor Portal) in Third-party Risk Management?
- A. To give TPR assessors a place to review third-party responses and generate issues from them
- B. To give internal stakeholders a place to complete their inherent risk questionnaires (IRQs)
- C. To give TPR admins an interface for configuring risk rating scales and scoring rules
- D. To give external vendor users a secure interface to view and complete assessments and tasks ✓
Why: The Third-party portal (at /svdp) gives third-party contacts, who are external users, a secure place to respond to questionnaires, document requests, tasks, and issues. TPR assessors review responses and raise issues in the Vendor Management Workspace, internal users complete IRQs and other internal assessments in the GRC portal, and risk rating scales and scoring rules are configured internally by TPR admins.
Which type of user account is provisioned for third-party contacts to access the Third-party portal?
- A. An internal user account with snc_internal so the contact can open assigned records
- B. A TPR assessor account so the contact can answer its own external questionnaires
- C. An external user account with limited, portal-appropriate roles/permissions ✓
- D. A Third-party assessment reviewer account with read access to its own templates
Why: Third-party contacts are external users. They get the vendor_contact role, which provides portal access and includes snc_external, which restricts them to the portal only. The docs warn that adding snc_internal could let the contact log in to the platform and see critical records, and the TPR assessor and Third-party assessment reviewer roles are internal roles for the assessment team, not for respondents at the third party.
Why is access control especially important in the Third-party portal?
- A. External users can reach Vendor Management Workspace records unless the portal is restricted first
- B. External vendor users must only see their own organization's data, not other vendors' information ✓
- C. External users must be blocked from all issues, even those marked Visible in third-party portal
- D. External users need the same roles as TPR assessors so they can score their own responses
Why: Portal access control must restrict each third-party user to their own organization's data, preventing cross-third-party exposure. The vendor_contact role already includes snc_external, which limits contacts to the portal rather than the workspace; issues marked Visible in third-party portal are meant to be shown to the contact; and scoring belongs to the internal team, so contacts never get assessor roles.