CIS-TPRM Study Guide: ServiceNow Certified Implementation Specialist, Third-party Risk Management

Trademark disclaimer. ServiceNow, Now Platform, and all related product and release names (for example Vendor Risk Management, Third-party Risk Management, Smart Assessment Engine, Integrated Risk Management, CMDB) are trademarks or registered trademarks of ServiceNow, Inc. BitSight, SecurityScorecard, RiskRecon, UpGuard, Interos, EcoVadis, and Black Kite are trademarks of their respective owners. This is an independent, original study aid for exam preparation. It is not affiliated with, endorsed by, or sponsored by ServiceNow, Inc. All prose is original and written for learning purposes.

Naming note (read first). The product was renamed from Vendor Risk Management (VRM) to Third-party Risk Management (TPRM) in the Vancouver release, and "vendor" was changed to "third party" throughout the user interface. Older study material, and the blueprint domain names below, still use VRM-era wording (vendor tiering, vendor assessments, Vendor Portal). This guide uses the Zurich names. Some technical names keep the old wording: the application scope sn_vdr_risk_asmt, the vendor_contact role, the Vendor Risk Management Workspace application sn_vrm_ws, and the GRC: Vendor Portal plugin. Day to day, internal users work in the Vendor Management Workspace (Risk tab) and external users work in the Third-party portal. Confirm the current exam code and title in the official ServiceNow certification catalog.

Exam at a glance: 60 questions, 90 minutes; multiple choice (single answer) and multiple select. Seven weighted domains. This guide is ordered by exam weight, heaviest first, so your study time tracks the question count.

#	Domain	Weight
3	Assessment Configuration	25%
1	VRM Fundamentals and Review	24%
5	Vendor Portal Configuration	15%
2	Core Configuration	13%
4	Risk Issues and Processes	13%
6	Other Application Relationships	5%
7	Dashboards and Reports	5%

Domain 3: Assessment Configuration (25%)

This is the single heaviest domain. Master how assessments are built, generated, scored, and progressed through their life cycle.

Building blocks: templates, questionnaires, document requests

A third-party risk assessment is a set of questionnaires sent to third-party contacts or internal users. One sent to internal users is an internal assessment (in Zurich, tiering assessments are named internal assessments); one sent to a third-party contact is an external assessment (number prefix VRA). External assessments combine questionnaires (questions the third party answers) and document requests (artifacts such as SOC 2 reports that the third party uploads). Both feed the assessment rating.

Assessment templates are reusable groupings of questionnaire templates and document request templates, so the same set can be sent to similar third parties in future assessments. The TPR admin defines questionnaire and document request templates; the TPR manager groups them into assessment templates. Scoring is configured separately, in the scoring setup (risk domains, criteria, and scoring rules) and the risk rating scale. Do not change a questionnaire template after it has been sent; duplicate it instead.

TPRM supports the SIG (Standardized Information Gathering) questionnaire from Shared Assessments through the GRC: SIG Questionnaire Integration (SIG Full, Core, and Lite templates). The sample SIG templates do not include correct answers, so you define correct answers and scoring yourself. Third-party contacts can also answer with a Microsoft Excel template and import it in the portal.

Risk domains (risk areas) and weighting

A risk domain (called a risk area on forms and in some applications) defines a type of risk to assess, for example security risk for a data-management third party or financial risk for a bank. Each risk domain definition has a default scoring method (Average Risk, Max Risk, or Min Risk) and a default weight. Risk area criteria group the risk domains that apply to a type of third party or engagement, and component criteria weight the components (for a third party: external risk assessments, subsidiaries, engagements, risk intelligence rating). Scoring rules apply the criteria to third parties and engagements and roll ratings up with MIN, MAX, or AVG.

Scoring and rating calculations (classic engine)

Under the classic assessment engine, each question gets a rating from its response (scored questions are 0 or 1), a percent contribution from its weight within the category, and a normalized value (100 x rating x percent contribution). A category rating is the sum of its questions' normalized values, and the category normalized value is the category rating multiplied by the category weight. The questionnaire score is the sum of the normalized category scores, and the assessment rating is the weighted average of the questionnaires and document requests within each risk area, with weights set by the risk area scoring method. Only answered questions count. If a third party or engagement is associated with a business service in the Service [cmdb_ci_service] table, that service's criticality weight (Business Service Rating Scale, 1 most critical to 4 not critical) is factored in.

The score is mapped to a rating through the risk rating scale. The base system has five ratings with configurable minimum and maximum values; Zurich forms show Critical, High, Moderate, Low, Minor. In the default settings, scores of 20 through 39 indicate high risk and 60 through 79 indicate low risk.

Watch the direction of the scale. A higher score means lower risk: a score near 0 maps to Critical, a score near 100 maps to Minor.

Smart Assessment Engine (SAE)

The Smart Assessment Engine is the GRC-wide assessment engine. In TPRM it is turned on with the Smart Assessment Engine enabled [sn_vdr_risk_asmt.sae_enabled] property, and the change cannot be reversed; after that, new assessments must use SAE templates, created in the Vendor Management Workspace. Classic configuration is still documented in Zurich for instances that have not switched.

Key SAE points for TPRM:

Templates have sections and subsections, reference information, conditional visibility, auto-save, a duration, and a template-level risk rating scale; TPRM SAE templates add the risk area and the Include previous responses option.
Scoring can be configured at question, subsection, section, and assessment levels, with optional normalization.
Question-level comments, work notes, and flags are available to reviewers.
Limitations: no issues from the View responses page (use issue generation rules), no signature feature, no automatic attachment of external questionnaires from IRQ responses or IRQ-calculated tiers, no Excel export in the portal, unsupported question types (percentage, ranking, image scale, custom metric), and no repeating assessments (use event-driven management rules).

Assessment generation, scheduling, and automation rules

Assessments can be created manually or by rules:

Tier-based rules tie a third-party tier to an assessment template.
Provider-based submission rules act when a risk intelligence provider's score or rating changes (by percentage, score, threshold, or rating); the action can create and send an assessment, an issue, a task, or an email.
Event-driven management rules generate and send questionnaires and document requests to third parties or engagements that meet defined criteria, with a one-time, recurring, or on-demand run type. They can also start reassessment, renewal, or offboarding due diligence, but not onboarding. With SAE they replace repeating assessments.
Assessment scheduling (formerly Repeating assessments) is the classic-engine way to recur an assessment for a third party or engagement.
Issue generation rules create issues from responses to selected questions when the assessment moves to Generating observations.

With SAE enabled, tier-based, provider-based, event-driven, and issue generation rules run only for assessment templates marked Supports smart assessment.

External assessment life cycle states

Draft, then Submitted to third party, Responses received, Generating observations, Finalizing with a third party, and Closed. During Submitted to third party the third party works the questionnaires, tasks, and issues. In Generating observations the system can auto-generate issues; in Finalizing with a third party the team reviews all data and can reset to Draft. Closing an assessment for an engagement that will be contracted starts the contract risk process.

Do not confuse record types. Classic questionnaire requests (formerly assessment instances) use Ready to take, In progress, Complete, Canceled; classic questionnaires use New, Submitted, In Progress, Received, Returned, Canceled; SAE questionnaires use In progress, Completed, Canceled. Third-party risk issues start in New and close as Closed Complete, Closed Incomplete, or Closed Cancelled.

Domain 1: VRM Fundamentals and Review (24%)

What the product does

ServiceNow Third-party Risk Management provides a centralized process for managing your portfolio of third parties and their engagements, assessing and scoring risk, and performing remediation. Key capabilities: onboarding, offboarding, renewal, and other due diligence workflows; assessment management; continuous risk monitoring; and risk performance management.

VRM to TPRM rename and scope

The application was renamed from Vendor Risk Management to Third-party Risk Management in the Vancouver release. The rename brought the due diligence request workflow and internal assessments, relabeled Third-party Scores as Risk Intelligence Scores, and replaced "vendor" with "third party" in the UI. A third party is any organization or individual you interact or have a business relationship with: vendors are one type, alongside suppliers, affiliates, consultants, partners, resellers, distributors, outsourced staff, and even customers and clients.

Third parties, engagements, subsidiaries, fourth parties, and tiers

Third party is a Company [core_company] record; every third party must be categorized as a Vendor in that table.
Engagement [sn_vdr_risk_asmt_vendor_engagement] is the informal or contracted relationship you intend to form with a third party, describing the services or products provided. One third party can have many engagements, and issues, tasks, internal assessments, and external assessments are associated with engagements.
Subsidiaries are organizations owned or controlled by the third party; their ratings contribute to the controlling third party's score.
Fourth through nth parties contract with a third party (they are not owned by it) and are tracked on the third party's Downstream suppliers tab.
Third-party elements (facility, principal, product, other, and AI use cases or models) are what a third party or engagement relies on, and can be collected and assessed during due diligence.
Tiers and ratings: internal assessments calculate third-party and engagement tiers and the risk rating (Zurich renamed the Tier-level column to Risk rating). The IRQ process replaces the original tiering assessment process; risk tiering remains supported as a legacy process.

Inherent Risk Questionnaires (IRQs) and due diligence

An Inherent Risk Questionnaire (IRQ) is answered by internal employees during the internal assessment to assess inherent risk (risk before mitigation), considering factors such as the nature of the services, data sensitivity, geographic location, and security posture. The results decide whether to engage, what level of due diligence is required, and which external questionnaires to send. In the classic engine, IRQ responses or the IRQ-calculated tier can automatically attach external questionnaires (not supported in SAE).

The due diligence workflow (Due diligence request workflow application [com.sn_tprm_dd]) runs these processes in order:

Request: an employee raises a due diligence request in Employee Center to onboard a new engagement, reassess an engagement, reassess for contract renewal, or offboard an engagement with or without due diligence. The Due diligence request assignment group assigns a TPR manager or TPR assessor as owner, who scopes and approves or rejects it.
IRQ process: the owner attaches an IRQ to an internal assessment; the IRQ assessor (an internal user named on the request) responds; the owner reviews and closes it.
Third-party element collection (optional).
Due diligence: external assessments are sent to the third-party contact and the engagement contact; issues and tasks are raised as needed; the request reaches Ready for TPRM approval.
Approval: approvers (TPR approver role) review and approve or reject; closing the approved request makes the third party or engagement Active.
Contract risk process (optional): the contract negotiator executes, skips, or rejects the contract.

Domain 5: Vendor Portal Configuration (15%)

The Third-party portal

The Third-party portal (formerly the Vendor Portal) is the point of interaction between third parties and risk assessors. Third-party contacts open it at [instance URL]/svdp to respond to questionnaires, document requests, tasks, and issues, upload documents, and manage their team. The portal is fully isolated from the internal instance. Issues and tasks appear there only when Visible in third-party portal is selected.

External user access and roles

Third-party contacts are external users. Each is automatically assigned:

vendor_contact: grants access to the Third-party portal (it contains snc_external).
snc_external: restricts the user to the portal only.

With SAE, contacts also receive sn_vdr_risk_asmt.external_assessment_responder to answer external questionnaires. Give the third-party contact role only to external users; a contact who also holds snc_internal could reach the platform.

Contacts and the primary contact

Each third party must have at least one primary contact. There are four contact role types: third-party primary, third-party secondary, engagement primary, and engagement secondary. An engagement needs an engagement primary contact before engagement-level questionnaires can be sent. Primary contacts invite contacts, assign contacts to engagements, delegate work, and deactivate contacts.

How questionnaires are assigned depends on the engine:

Classic: the questionnaire goes to a single primary contact (alphabetical order), who completes and submits it.
SAE: all primary contacts are assigned; one (alphabetical by last name) is the questionnaire owner, the others are contributors; only the owner submits or reassigns ownership, and the owner can add secondary contacts as contributors.

Internally, a TPR manager (with an admin for some steps) creates the third-party contact record (User ID, third party, Active, Primary contact); submitting it emails the contact the portal link and login credentials. From the contact record you can Resend Invite, lock out, deactivate, set a password, or reset a password.

Responding to assessments

Contacts answer in the portal (responses save automatically), use the Excel template (download, complete offline, import the .xlsx), or use the SIG format. In the classic engine, items that require an e-signature are signed with Save and Sign (typed or drawn); the signature feature is not supported for SAE questionnaires. The organization name shown in the portal comes from the TPRM property sn_vdr_risk_asmt.company.name.

Domain 2: Core Configuration (13%)

Roles

Third-party reader [vendor_reader]: read access to third-party contact records.
Third-party editor [vendor_editor]: create, update, or delete third-party contact records.
Third-party assessment reviewer [sn_vdr_risk_asmt.vendor_assessment_reviewer]: view assessment and questionnaire data and comment; contains vendor_reader. Minimum role to view TPRM templates.
TPR assessor [sn_vdr_risk_asmt.vendor_assessor]: reviewer permissions plus manage third parties, contacts, external risk assessments, issues, and tasks; contains the reviewer role, vendor_editor, and vendor_reader.
TPR approver [sn_vdr_risk_asmt.approver]: reviewer permissions plus approving IRQs and due diligence requests.
TPR manager [sn_vdr_risk_asmt.vendor_risk_manager]: assessor permissions plus assessment templates, scheduled assessments, engagements and engagement contacts, and scoring rules.
TPR admin [sn_vdr_risk_asmt.vendor_risk_admin]: manager permissions plus creating and editing assessment, risk tiering, risk tier questionnaire, questionnaire, and document request templates and post-assessment automation rules; configures TPRM properties.
Contract risk negotiator [sn_vdr_risk_asmt.contract_negotiator]: assessor permissions plus the contract risk process.
Third-party / engagement contact [vendor_contact]: external portal users.

Plugins / Store applications to activate

Third-party Risk Management [com.sn_vdr_risk_asmt] (load demo data to get the sample questions)
Due diligence request workflow (Third-party Risk Due Diligence) [com.sn_tprm_dd]
Vendor Risk Management Workspace application [sn_vrm_ws], which provides the workspace users open as the Vendor Management Workspace

Other setup tasks: an authentication policy for external third parties, roles and groups, TPRM properties, the optional Risk concentration map (needs a Google license), email with third-party contacts, optional import of existing data, third-party contacts, and optional quick-start tests.

TPRM properties

Configured by the TPR admin at Third-party Risk Management > Administration > Properties: organization name shown in the portal, Excel delimiter and maximum file size, maximum age for reusing responses, whether assessors can answer or edit questionnaires for contacts (sn_svdp.allow_assessor_edit, classic only), and Smart Assessment Engine enabled (irreversible).

Domain 4: Risk Issues and Processes (13%)

Issues

A third-party risk issue [sn_vdr_risk_asmt_issue] (number prefix VRI) records a concern that must be remediated. The issue form has Name, Description, Applies to (third party, engagement, or element), Third party, Assessment, State, Priority, Assignment group, Assigned to, Third-party contact, Watch list, Visible in third-party portal, and a Recommendation (Third party to remediate, Accept issue, or Request additional information) with an Explanation. Issues are created manually by a TPR assessor (optionally from a template), automatically by issue generation rules, or by provider-based submission rules.

Remediation tasks and closure

Tasks [sn_vdr_risk_asmt_task] (prefix VRT or VRIT) can be associated with a third party, engagement, element, assessment, or issue. External tasks go to third-party contacts and can be shown in the portal; internal tasks go to internal users and never appear in the portal. Task states: Open, Submitted to respondent (internal) or Submitted to third party (external), Work in progress, Review, Closed complete, Closed incomplete, Closed cancelled. Tasks carry planned start and end dates, and the issue page shows tasks by planned end date. On the external assessment, the issue risk rating uses the priority of closed issues and how they were resolved.

Monitoring drives issues

When a risk intelligence provider's rating changes, a provider-based submission rule can create an issue, task, assessment, or email. Issue generation rules create issues from questionnaire responses.

Domain 6: Other Application Relationships (5%)

Governance, Risk, and Compliance (GRC / IRM)

TPRM is one of ServiceNow's Governance, Risk, and Compliance products (marketed as Integrated Risk Management). Its engagements relate to the shared Risk [sn_risk_risk] and Control [sn_compliance_control] records.

Policy and Compliance Management: compliance managers associate control objectives and controls with third parties, engagements, and classic questionnaire questions; incorrect answers mark the linked controls non-compliant (SAE uses post-assessment actions instead). All third parties are categorized into an entity type called Vendors. TPRM consumes compliance objects read-only.
Risk Management: risks and risk statements can be associated with third parties and engagements, influencing their risk posture and scoring.

CMDB

Third parties and engagements can be associated with business services in the Service [cmdb_ci_service] table, and in classic scoring the business service criticality weight is factored into the score.

Continuous monitoring: risk intelligence providers

Register a provider, set up its services and how their scores map to TPRM ratings, and add scores to third parties (risk data is requested for third parties, not engagements). ServiceNow-supported integrations: Shared Assessments (SIG content) and EcoVadis (sustainability ratings). Partner integrations include BitSight, SecurityScorecard, RiskRecon, UpGuard, Recorded Future (cyber), Black Kite, Interos (supply chain and multiple domains), TruSight, and ISS Corporate Solutions. If a provider is not listed, no packaged integration exists; you can build one with Integration Hub.

Domain 7: Dashboards and Reports (5%)

Vendor Management Workspace

Open Workspaces > Vendor Management Workspace and select the Risk tab. Pages: Home (Third-party risk overview, quick actions, Risk rating by risk tiers, Top risk areas, Issues by priority, Fourth-nth party overview), Due diligence management, Risk activity, Dashboards, Risk concentration map, Task, Unified content management, and List.

Dashboards

The Dashboards page holds the Third-party insights and TPRM custom analytics dashboards. TPR managers and TPR admins can edit them; TPR assessors and reviewers see the responses assigned to them. Teams can create and share additional dashboards.

Legacy Vendor Risk Overview

The Vendor Risk Overview page (All > Third-party Risk Management > Overview) is a legacy view, replaced by the third-party risk reports in the Vendor Management Workspace; the dashboard is deprecated from version 18.1.3 and remains only on instances installed before that version.

Fast-recall cheat list

Exam: 60 Q / 90 min; single + multi-select. Heaviest domains: Assessment Configuration 25%, VRM Fundamentals 24%.
Rename: VRM to TPRM in Vancouver; "vendor" became "third party" in the UI; technical IDs keep vdr and vendor.
Third party: Company [core_company] categorized as a Vendor; engagements, subsidiaries, fourth parties, elements.
Assessments: internal (IRQ, formerly tiering) and external (VRA) assessments; external = questionnaires + document requests; assessment templates group them.
Risk domains: each with a default scoring method (Average, Max, Min Risk) and weight; criteria and scoring rules roll ratings up by MIN, MAX, or AVG.
Classic scoring: normalized question values sum to category ratings; category rating x category weight; assessment rating is the weighted average per risk area.
Rating scale: five ratings (Critical, High, Moderate, Low, Minor); higher score = lower risk.
SAE: sn_vdr_risk_asmt.sae_enabled, irreversible; no signature, no IRQ auto-attach, no repeating assessments.
Automation: tier-based rules, provider-based submission rules, event-driven management rules, issue generation rules, Assessment scheduling (classic).
Assessment states: Draft, Submitted to third party, Responses received, Generating observations, Finalizing with a third party, Closed.
Due diligence: Request, IRQ, element collection (optional), Due diligence, Approval, Contract risk (optional).
Portal: /svdp; vendor_contact (contains snc_external); at least one primary contact; SAE owner and contributors.
Roles: reviewer, assessor, approver, manager, admin, contract negotiator (sn_vdr_risk_asmt.*), plus vendor_reader, vendor_editor, vendor_contact.
Plugins: com.sn_vdr_risk_asmt, com.sn_tprm_dd, sn_vrm_ws.
Issues: VRI; Priority, Assignment group, Assigned to, Recommendation (remediate, Accept issue, more info); tasks VRT, internal or external.
Providers: EcoVadis and SIG (ServiceNow); BitSight, SecurityScorecard, RiskRecon, UpGuard, Recorded Future, Black Kite, Interos, TruSight (partners).
Reporting: Vendor Management Workspace Risk tab; Third-party insights and TPRM custom analytics dashboards; Vendor Risk Overview is legacy.

Facts in this guide were checked against the Zurich product documentation on servicenow.com/docs (October 2026). See grounding.md for source links.