Domain 3 · Objective reference 3B5 · Chapter 22 of 35
Manage suppliers and fourth-party dependencies
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Outsourcing work does not remove accountability.
Explore the anchors
Evaluate supplier risk and dependencies.
Concept matching activity
Match this task or description to its concept:
Set obligations assurance and response paths.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Manage the supplier lifecycle
Management concept and decision mechanism
Supplier security spans selection, contracts, implementation, monitoring, change and exit. Establish the service, information, identity, incident, recovery and subcontracting boundaries. Review assurance for product scope, period, exceptions, subservice dependencies and required customer controls. A supplier’s certificate does not discharge retained customer duties. Consider concentration, transferability of data and access revocation if the relationship ends. For AI-enabled services, clarify permitted data use, retention, model access and change visibility. A contractual exit right needs an executable retrieval and transition plan to be useful during disruption.
Manage the supplier lifecycle
Assess suppliers before engagement, agree requirements, and verify operation throughout the relationship. Consider subcontractors, material service changes, incident communication, recovery capability, and exit arrangements. The depth of review should reflect the service's importance and exposure.
Review evidence for scope and date. A report about one service or period may not cover the system you are buying. Track exceptions and corrective actions. On exit, address access removal, data return or disposal, and continuity of dependent business activities.
Worked example
A service report excludes a critical subcontractor. The customer records the assurance gap and seeks appropriate evidence or treatment rather than presenting an unconditional supplier pass.
Check your understanding
What is a fourth-party dependency in this context?
Show explanation
A service or provider used by the direct supplier whose failure or access can affect the customer’s service or information.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.