Select Page



Predicting the Privacy Weather Report for Third Party Risk

The dialog on online privacy is heating up in Washington D.C. this week as hearings and industry discussion on the merits of federal privacy legislation were prompted in the wake of the passage of the California Consumer Privacy Act (CCPA). … Read More

Visit Blog


The Internet of Things (IoT): A New Era of Third-Party Risk

Given the proliferation of connected devices, today’s cyber climate is evolving and organizations have to shift their focus to the. … Read More



Certified Third Party Risk Professional (CTPRP)

The CTPRP validates expertise, teaches the latest developments in third party risk and increases professional credibility and recognition. Available online and in-person.

Learn More


Why are we the trusted source in third party risk?


Shared Assessments provides the best practices, solutions and tools for third party risk management with the mission of creating an environment of assurance for outsourcers and their vendors. With over a decade of experience in third party risk, Shared Assessments is unique in that it is member-driven. Our membership has its foundation in the regulatory and compliance-driven big banks, but has grown to include organizations in a breadth of industries in search of good third party risk management as a standard operating practice. Our membership, along with internal third party risk experts, develop standardized resources for managing the complete third party relationship lifecycle. Standardization is critical to the advancement of effective, secure third party controls and risk management in an otherwise fractured market. As a part of elevating standardization, the Shared Assessments Program has created a suite of third party risk management tools to create efficiencies and lower costs for all participants, keep current with regulations and apply industry standards and guidelines to the threat environment as it evolves.
Learn More

The Toolkit

  • The Standardized Information Gathering (SIG) questionnaire collects the information necessary to conduct an initial assessment of a service provider’s controls.
  • The Standardized Control Assessment (SCA) procedures verifies a service provider’s answers to the SIG with onsite and other validation assessments.
  • The Vendor Risk Management Maturity Model (VRMMM) is a free tool to benchmark third party risk management programs.
  • The GDPR Privacy Tools helps organizations manage their privacy programs beyond the scope of GDPR to assess data processor controls.

Learn More