Supply Chain & Third-Party Cyber Risk Training
A one-day fundamentals workshop for teams selecting or managing suppliers. Participants map a fictional outsourced service, ask proportionate security questions and practise assigning actions when a supplier incident affects business operations.
Who should attend: Procurement, vendor managers, operations, risk, compliance and business service owners. No prior cybersecurity qualification is required.
HRD Corp claim support available
Programme Focus
The focus is business supplier oversight and cyber dependency. SOC 2 Fundamentals helps teams read provider assurance, while broader vendor-management courses address commercial relationships.
Programme Agenda
9:00 AM to 10:00 AM
Find the Dependencies That Matter
Map the service, information, access and subcontractors involved in an outsourced activity. Identify the internal owner and the business impact if a key dependency fails.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Risk-Based Supplier Questions
Design a short set of questions matched to the service's risk. Ask about access, data protection, resilience, incident contacts and relevant assurance evidence without treating a completed questionnaire as a guarantee.
11:30 AM to 12:30 PM
Reading Assurance With the Right Scope
Review a fictional certificate or report summary for the named entity, scope, dates and exceptions. Identify follow-up questions and the responsibilities that remain with the customer organisation.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Contracts, Access and Onboarding
Identify issues to refer to procurement, legal and technical owners, including incident communication, access approval, subcontractors and service exit. Practise documenting a gap and its accountable decision-maker.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Monitoring, Incidents and Exit
Set practical review triggers for material changes, expiring evidence and supplier incidents. Plan who receives updates, checks essential operations and coordinates removal or return of access and information at exit.
4:00 PM to 5:00 PM
Practical Exercise: A Supplier Incident Reaches Your Team
Assess a fictional payroll provider before onboarding, then respond to a service-disruption notice. Produce a dependency map, supplier questions and prioritised follow-up actions.
Key Outcomes
- Map critical supplier dependencies
- Ask proportionate cyber-risk questions
- Check the scope of assurance evidence
- Assign incident, monitoring and exit responsibilities
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior cybersecurity experience required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
Examples include Malaysian outsourcing arrangements, payroll providers, cloud applications and service partners. The course distinguishes collecting supplier assurances from checking whether they cover the service and data actually in use.
Practical Takeaways
A supplier cyber-risk screening worksheet and assurance follow-up checklist.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
Participants receive an Orbix Certificate of Completion upon full attendance. This introductory programme does not confer a professional qualification, certify an organisation, or replace organisation-specific technical, legal or regulatory assessment.
Frequently Asked Questions
Related Fundamentals Training
SOC 2 Fundamentals. Stakeholder & Vendor Management. View all fundamentals programmes
Reference material: NIST: cybersecurity supply chain risk management. NIST: SP 800-161 Revision 1.