Third-party risk

Separate intake assertions, public information and verified evidence.

What the baseline contains

10 structured records from P03_TPRM. The source workbook is a historical portfolio model, not verified operational evidence.

What is implemented

Typed vendor intake produces a tier and recommendation. Missing processor agreements, subprocessor authorization or current evidence block progression.

Inspect the engineering

engine/decisions.py and engine/mcp_server.py in the downloadable repository package. Open the executive observatory to inspect the modeled risk register and current technical snapshot.

Decision boundary

Vendor names and historical public sources are not proof of present security posture. No agent can approve a contract or accept risk.

Review procedure

1. Establish system scope, owner, observation period and evidence provenance.
2. Execute the applicable check and inspect unknown, stale or failed results.
3. Record an evidence-linked finding, assign a treatment owner and set a review date.
4. Retest with new evidence. Keep the earlier snapshot and the reviewer’s conclusion.