Courses
Courses that leave you with real work done.
Each course is built around a task you do at work, like running a SOC 2, answering a breach, or putting AI to use safely. You finish with a working deliverable built on your own organization, whether you are a team of five or five thousand, and a certificate anyone can verify.
87courses
12domains
5credential paths
273ALCs to earn
7included with Associate Membership
The course mapEvery course, by domain. Pick a credential to light up the courses that count toward it.
Included with Associate MembershipPractitionerExecutive Practitioner
Concepts you hear but never learned Included
16 ten-minute lessons, included with Associate Membership. 0.25 ALC each, toward the Foundations Certificate. Open the series.
Bridge letterTPR · 10 minutes
CUECTPR · 10 minutes
Subservice organisation and carve-outTPR · 10 minutes
Global Privacy Control (GPC)PRV · 10 minutes
TCF and consent stringsPRV · 10 minutes
SBOM and VEXCYB · 10 minutes
Statement of ApplicabilityGRC · 10 minutes
ITGCAUD · 10 minutes
Legitimate interest and the balancing testPRV · 10 minutes
Article 28 processor termsPRV · 10 minutes
Business associate agreementPRV · 10 minutes
Risk acceptance and expiryRSK · 10 minutes
Type I versus Type IITPR · 10 minutes
Data processing agreement versus data protection addendumPRV · 10 minutes
Suppression listPRV · 10 minutes
Population and sampleAUD · 10 minutes
Third-Party & Supply Chain Risk
10 coursesAIW-302Practitioner
AI in Third-Party Risk: Questionnaires and Evidence
Vendor reviews pile up because questionnaires and SOC reports take hours to read. Let AI do the reading while your team makes the risk calls.
4 ALCs
TPR-201Practitioner
Building a Third-Party Risk Program: From Zero and At Scale
You can't review every vendor the same way. Build a third-party risk program, from scratch or at scale, with tiering that puts effort where the risk is.
4 ALCs CDTP CTTP
TPR-210Practitioner
Reading a SOC 2 Report: Opinion, Scope, Exceptions, CUECs and Subservice Organizations
A SOC 2 report can look clean while missing exactly what you rely on. Read the opinion, scope, exceptions, CUECs and carve-outs like an auditor.
3 ALCs CTTP
TPR-215Practitioner
Handling CUECs: Turning Complementary User Entity Controls Into Your Own Obligations
Every SOC report hands you controls you're expected to run. Turn complementary user entity controls into your own obligations, with owners and evidence.
2 ALCs CTTP
TPR-220Practitioner
Vendor Due Diligence Questionnaires: SIG, CAIQ, Custom and Scoring
Long questionnaires waste everyone's time and still miss the risk. Build tiered questionnaires, score them with partial credit and ask only for evidence that…
3 ALCs CTTP
TPR-230Practitioner
Contracting for Risk: DPAs, BAAs, Security Schedules and Right to Audit
Contracts are the only leverage you have after signature. Know which clauses matter in DPAs, BAAs and security schedules, and how hard to push by vendor tier.
3 ALCs
TPR-240Executive
Continuous Vendor Monitoring: Breach Intelligence, Attestation Expiry and Recertification
Vendor risk changes between annual reviews. Monitor vendors continuously, catch expiring reports and DPAs, and offboard cleanly.
3 ALCs CTTP
TPR-250Executive
Fourth-Party and Concentration Risk
Your vendors' vendors can take you down. Map subprocessors and spot concentration risk in the services you depend on most.
2 ALCs
TPR-260Practitioner
Answering Customer Security Questionnaires: The Other Side of the Table
Security questionnaires from customers can stall deals for weeks. Answer them fast and accurately, and use a trust center to cut the volume.
3 ALCs
TPR-270Executive
Regulated Outsourcing: DORA, OCC and FCA Registers in Practice
Regulators now expect registers of your ICT third parties and exit plans that would work. Meet DORA, OCC and FCA outsourcing requirements in practice.
3 ALCs