Integrate cybersecurity into TPRM to reduce vendor breach impact, meet DORA and NIST C-SCRM expectations, and monitor fourth-party exposure using SBOM-driven diligence, threat intelligence, and automation.
Key Features
- Design a lifecycle-based TPRM program that ties vendor decisions to cyber risk
- Map DORA, NIST C-SCRM, and ISO/IEC 27036 controls to audits and evidence
- Build contract clauses, SBOM requirements, and playbooks for third- and fourth-party breaches
- Includes assessment templates, evidence checklists, and incident playbooks you can adapt
Book Description
Reduce supply chain cyber risk by turning third-party risk management into an operational program that connects procurement, legal, and security decisions. This book replaces checkbox assessments with a lifecycle approach you can apply from onboarding through offboarding, so vendor risk tiering, control mapping, and continuous monitoring drive clear outcomes.
You learn how to align supplier oversight with major obligations and guidance, including DORA, GDPR, Executive Order 14028, NIST C-SCRM, and ISO/IEC 27036. You also get practical methods for strengthening contracts and SLAs—covering audit rights, breach notification, liability, and security requirements that flow down to critical subcontractors.
From threat intelligence and security ratings to incident response playbooks for vendor and sub-vendor breaches, the book shows how to handle real signals, not just survey answers. Written by practitioners with deep experience in supply chain risk and offensive security, it also explains how SBOM standards and AI-assisted scoring can support scalable governance. By the end, you can build and mature an intelligence-driven TPRM program focused on measurable resilience.
What you will learn
- Learn how vendor ecosystems become attack paths
- Categorize third- and fourth-party supply chain risks
- Create risk tiers and segmentation based on business impact
- Design a lifecycle workflow from onboarding to offboarding
- Select controls using NIST and ISO supply chain guidance
- Translate DORA, GDPR, and EO 14028 duties into controls
- Prepare evidence packs for audits and regulator questions
- Plan continuous monitoring beyond annual questionnaires
Who this book is for
This book is for cybersecurity leaders, TPRM/VRM practitioners, risk managers, and procurement professionals who need a repeatable way to evaluate and monitor vendors and critical suppliers. Compliance teams and in-house counsel working with DORA, GDPR, HIPAA, and related requirements will also benefit. Basic familiarity with security principles and vendor management helps.
Table of Contents
- The Disconnect — TPRM vs. Cybersecurity in the Supply Chain
- The New Attack Surface — A Taxonomy of Supply Chain Risks
- The Foundational Framework — A TPRM-Driven Security Lifecycle
- The Regulatory Blueprint — Navigating Key Frameworks
- The Legal Foundation of Embedding Cybersecurity into Contracts
- The Unseen Threat – Managing Fourth-Party Risk
- Deep Dive – Threat Intelligence: Uncovering Hidden Supply Chain Risks
- The Incident Blueprint - Responding to Third- and Fourth-Party Breaches
- Measuring and Advancing TPRM Maturity
- Connecting TPRM and SCM – Due Diligence of Suppliers and Understanding Threats
- Understanding Your Service Provider's Software Bill of Material
- The Technological Imperative – Leveraging AI and Automation
- The Software Ingredient List – SBOM and Supply Chain Security
- Building an Advanced Program - From Compliance to Resilience
Eric Richardson has had a distinguished technology career in roles from CISO/ to executive to volunteer AP Comp Sci teacher with over 30 years of experience specializing in the critical intersection of Cybersecurity, Artificial Intelligence, and Operational Risk. Currently serving as the Global Leader of Artificial Intelligence and Security Engineering at Cisco, he spearheads corporate-wide standards for secure AI implementation and evaluates complex architectures to ensure robust security controls. His deep technical expertise in AI is evidenced by his authorship of "Prompt Engineering: Hands-on guide to prompt engineering for AI interactions". Eric resides in Washington State with his Wife Stacie and his daughters Katie and Maddie. Eric possesses a Masters in Computer Science with a focus on cybersecurity Engineering as well as a MBA.
Filipi Pires is an internationally recognized cybersecurity leader, researcher, and global speaker specializing in adversary emulation, identity security, and offensive security operations. With over 15 years of experience in the cybersecurity industry, he has built a career at the intersection of technical research, product strategy, and community leadership, helping organizations understand, simulate, and defend against real-world cyber threats. He currently serves as Head of Technical Advocacy at SCYTHE, where he leads global initiatives focused on Breach & Attack Simulation (BAS) and Adversarial Emulation & Validation (AEV). In this role, Filipi works closely with enterprises, government organizations, and security teams worldwide to operationalize adversary simulation, validate defensive controls, and mature cyber resilience programs through realistic attack scenarios. Beyond his corporate role, Filipi is the Founder & Investor at CROSS-INTEL, a global cybersecurity consulting and market-expansion firm, and Advisor & Investor at Sherlockeye, an AI-driven OSINT intelligence platform designed to accelerate cyber investigations and threat intelligence operations. He serves as Organizer of BSides Porto, one of Europe's fastest-growing community cybersecurity conferences, and Director of the Red Team Village at DEF CON, one of the most respected offensive security communities in the world. He is also Senior Advisor at Raíces Cyber Academy and Founder of the Red Team Community across Brazil and Latin America, initiatives dedicated to developing the next generation of offensive security professionals. As an international conference speaker, Filipi has delivered technical presentations and research at many of the world's most prestigious cybersecurity events, including multiple editions of Black Hat USA, DEF CON, Black Hat Middle East & Africa, RSA Conference-related events, and numerous BSides conferences worldwide. His talks focus on identity-centric attack paths, cloud privilege escalation, supply-chain compromise, breach simulation, and real adversary tradecraft. He has been recognized among the Top 3% Most Active Security Speakers globally, reflecting both the volume and impact of his contributions to the industry. His industry recognitions include AWS Community Builder and Snyk Ambassador. He is also known globally as an advocate for hacking through his long-standing initiative “Hacking is NOT a Crime,” promoting responsible research, education, and collaboration across the cybersecurity ecosystem. Through his work spanning industry, research, education, and community leadership, Filipi Pires continues to advance adversary simulation practices, identity-focused security, and the global maturation of offensive cybersecurity capabilities.
