Global Learning for Operational Leaders
Classroom
14 sessions
Scroll for more
Online / Live
14 sessions
Scroll for more
Introduction
Course overview
Many major breaches have occurred through suppliers, service providers and software vendors. Organisations must assess and manage cyber risks across their supply chains.
This Aractech course covers supply chain cyber threats, vendor inventory and tiering, security assessments and questionnaires, contractual security requirements, continuous monitoring, software supply chain risks, incident coordination and regulatory expectations. Participants design a vendor cyber risk programme.
The course suits security, procurement and risk professionals.
What you will achieve
Learning objectives
- Explain supply chain cyber threats
- Inventory and tier vendors by risk
- Assess vendor security posture
- Include security requirements in contracts
- Monitor vendors continuously
- Coordinate incidents with suppliers
Who should attend
Target audience
- Information security managers
- Procurement and vendor managers
- Risk managers
- Compliance professionals
- IT managers
- Auditors
Methodology
Learning approach
- Case studies
- Tiering exercises
- Questionnaire design
- Contract clause reviews
- Programme design
Complete course outline
Five focused days of learning and application
The timings provided are estimates and may vary depending on the number of participants and the discussions taking place during the sessions. They are indicative only and do not constitute a binding commitment.
Day 1
Supply Chain Cyber Threats
- Third-party breaches
- Software supply chain attacks
- Cloud and managed services
- Regulatory expectations
- Coffee break
- Regulatory expectations (continued)
- Risk appetite
- Case study: Supply chain attack
Day 2
Vendor Inventory and Tiering
- Vendor inventory
- Data and access mapping
- Risk tiering
- Criticality
- Coffee break
- Criticality (continued)
- Ownership
- Workshop: Tiering model
Day 3
Assessment
- Questionnaires
- Evidence and certifications
- On-site and remote assessments
- Scoring
- Coffee break
- Scoring (continued)
- Remediation
- Exercise: Assessment review
Day 4
Contracts and Monitoring
- Security clauses
- Right to audit
- Incident notification
- Continuous monitoring
- Coffee break
- Continuous monitoring (continued)
- Offboarding
- Exercise: Contract clauses
Day 5
Programme Management
- Governance
- Metrics
- Tools
- Coffee break
- Tools (continued)
- Improvement
- Roadmap
- Capstone: Vendor cyber risk programme
FAQ
Frequently asked questions
What does Vendor and Supply Chain Cyber Risk (IMCS-031) cover?
This course covers IT Management and Cyber Security through a structured five-day outline focused on practical application, discussion, and implementation planning.
When is the next available session?
The next scheduled session starts on 2 - 6 November 2026. See the course schedules section for the available dates and delivery formats.
Who should attend this course?
Information security managers, Procurement and vendor managers, Risk managers
Is bilingual course delivery available?
Yes. All course materials and presentations are provided in English, while bilingual explanation and discussion support may be available depending on the selected location and trainer availability. For example, when attending a course in Istanbul, you may request a Turkish-speaking trainer to explain the English course content in Turkish. Arabic explanation support may also be requested at this location. Other languages are available in selected cities. You can choose your preferred language support as an optional preference during registration.
How can I register for a session?
Use any Register button next to the available course dates to open the participant registration page and submit your booking request for the selected session.
Is this course available online as well as classroom-based?
Check the course schedules section for currently published classroom and Online / Live sessions.
Where are classroom sessions delivered?
Current classroom venues include London, Istanbul, Rome, Kuala lumpur, Frankfurt, Geneva, Dubai.
How long is the training programme?
The programme runs for five days from 09:00 to 14:00, which gives 25 contact hours, including a daily 30-minute break (22.5 hours of instruction).
Quick request
Send quick request
Send a fast enquiry about this course and the academy team will get back to you.
Get a quotation
Request a formal quotation
Choose an available date and venue, add your participants, and we will email a formal quotation for Vendor and Supply Chain Cyber Risk to your business address.