TPRM-Driven Supply Chain Cybersecurity

Align TPRM and cybersecurity, classify supply chain risks, build a lifecycle program, and map NIST C-SCRM, ISO/IEC 27036, DORA, GDPR, and EO 14028 to evidence and audits.Key FeaturesAlign procurement, legal, and security priorities around shared risk outcomesApply a clear taxonomy for cyber, operational, regulatory, and reputational riskUse a lifecycle blueprint to structure assessment and ongoing oversightMap NIST C-SCRM, ISO/IEC 27036, DORA, and EO 14028 to audit evidenceBook DescriptionModern organizations rely on complex vendor ecosystems, but third-party risk management (TPRM) and cybersecurity often operate in silos. This book shows how to connect vendor risk management with supply chain cybersecurity using a practical, lifecycle-driven approach.You’ll design a program covering onboarding, vendor risk assessment, continuous monitoring, and offboarding. You’ll begin by examining why TPRM and cybersecurity often operate in separate lanes, and what that gap costs in downtime, breach impact, and compliance exposure. Next, you’ll develop a modern taxonomy of supply chain risk, including fourth-party dependencies and software supply chain concerns, so risk discussions use consistent categories and measurable assumptions.From there, you’ll adopt a lifecycle-based model to structure vendor onboarding, assessment, monitoring, and offboarding—supported by vendor tiering, segmentation, and control mapping. The final chapter focuses on the regulatory blueprint: how to interpret NIST C-SCRM, ISO/IEC 27036, DORA, GDPR, and Executive Order 14028, then convert them into evidence-driven controls and audit-ready documentation.What you will learnLearn how vendor ecosystems become attack pathsCategorize third- and fourth-party supply chain risksCreate risk tiers and segmentation based on business impactDesign a lifecycle workflow from onboarding to offboardingSelect controls using NIST and ISO supply chain guidanceTranslate DORA, GDPR, and EO 14028 duties into controlsPrepare evidence packs for audits and regulator questionsPlan continuous monitoring beyond annual questionnairesWho this book is forThis book is for cybersecurity leaders, TPRM/VRM practitioners, risk managers, and procurement professionals who need a repeatable way to evaluate and monitor vendors and critical suppliers. It also helps compliance stakeholders who need a shared, workable method to manage supplier cyber exposure. Basic familiarity with security principles and vendor management helps.

Eric Richardson has had a distinguished technology career in roles from CISO/ to executive to volunteer AP Comp Sci teacher with over 30 years of experience specializing in the critical intersection of Cybersecurity, Artificial Intelligence, and Operational Risk. Currently serving as the Global Leader of Artificial Intelligence and Security Engineering at Cisco, he spearheads corporate-wide standards for secure AI implementation and evaluates complex architectures to ensure robust security controls. His deep technical expertise in AI is evidenced by his authorship of "Prompt Engineering: Hands-on guide to prompt engineering for AI interactions". Eric resides in Washington State with his Wife Stacie and his daughters Katie and Maddie. Eric possesses a Masters in Computer Science with a focus on cybersecurity Engineering as well as a MBA. Filipi Pires is an internationally recognized cybersecurity leader, researcher, and global speaker specializing in adversary emulation, identity security, and offensive security operations. With over 15 years of experience in the cybersecurity industry, he has built a career at the intersection of technical research, product strategy, and community leadership, helping organizations understand, simulate, and defend against real-world cyber threats.He currently serves as Head of Technical Advocacy at SCYTHE, where he leads global initiatives focused on Breach & Attack Simulation (BAS) and Adversarial Emulation & Validation (AEV). In this role, Filipi works closely with enterprises, government organizations, and security teams worldwide to operationalize adversary simulation, validate defensive controls, and mature cyber resilience programs through realistic attack scenarios.Beyond his corporate role, Filipi is the Founder & Investor at CROSS-INTEL, a global cybersecurity consulting and market-expansion firm, and Advisor & Investor at Sherlockeye, an AI-driven OSINT intelligence platform designed to accelerate cyber investigations and threat intelligence operations.He serves as Organizer of BSides Porto, one of Europe's fastest-growing community cybersecurity conferences, and Director of the Red Team Village at DEF CON, one of the most respected offensive security communities in the world. He is also Senior Advisor at Raíces Cyber Academy and Founder of the Red Team Community across Brazil and Latin America, initiatives dedicated to developing the next generation of offensive security professionals.As an international conference speaker, Filipi has delivered technical presentations and research at many of the world's most prestigious cybersecurity events, including multiple editions of Black Hat USA, DEF CON, Black Hat Middle East & Africa, RSA Conference-related events, and numerous BSides conferences worldwide. His talks focus on identity-centric attack paths, cloud privilege escalation, supply-chain compromise, breach simulation, and real adversary tradecraft. He has been recognized among the Top 3% Most Active Se