Risk & governance · Fictional case study
Third-Party Security Risk Assessment
A fictional supplier-risk assessment with questionnaires and evidence reviews.
A simulated vendor due-diligence programme covering three fictional ICT suppliers, security questionnaires, evidence quality, risk scoring and conditional onboarding decisions.
- My contribution
- Modeled supplier due diligence and risk treatment
- Evidence / output
- Three suppliers, 72 synthetic responses and six modeled risks
- Scope
- Fictional training exercise
Repository updated · Snapshot checked 6 Nov 2026 (UTC)
03Fictional suppliers
72Modeled questionnaire responses
06Risk scenarios
01 / CONTEXT
Project context
Supplier due diligence must balance operational dependencies, uncertain control claims and business risk. The case study models how to turn incomplete supplier answers into transparent questions, risk treatment and decision gates.
02 / EXECUTION
What I did
- Designed a 24-question due-diligence questionnaire across security, privacy, governance and resilience.
- Assessed 72 fictional answers for three suppliers and recorded supporting or missing evidence.
- Modeled six risk scenarios with inherent and residual scores, corrective actions and evidence recalibration.
- Extended the exercise into monitoring, reassessment and proposed executive onboarding decisions.
03 / VERIFICATION
Evidence and outcomes
- Linked questionnaire, evidence register and risk scores provide an auditable training workflow.
- Later phases preserve and explain risk-rating corrections and decision changes.
- NIST CSF 2.0 supply-chain principles inform the structure.
Full documentation and source files are in the public GitHub repository.
04 / LIMITATIONS
Limitations
Scope
Entirely fictional vendor data and management decisions. Not a real supplier audit, contracted assessment or formal certification.