Free Practice Questions for the ServiceNow Certified Implementation Specialist CIS-TPRM Exam (2026 Updated)

A third-party assessment can be assigned in three baseline ways. An assessor or manager can create it manually for a chosen third party. It can be assigned automatically when the third party's tier changes, because the assessment configuration includes a trigger for tier changes that selects the template mapped to the new tier. It can also be assigned automatically through a Security Score rule, which responds to a change in the third party's security score from a risk intelligence provider.

Categorization and supported business services are not baseline triggers. Although categories and services describe the third party and may inform tiering, no out-of-the-box rule assigns an assessment solely because of them. Achieving that behavior would require customization or an event-driven rule.

The design intent is to link assessment effort to risk. A change in tier indicates that the third party's criticality has moved, and a change in security score signals deterioration or improvement that may justify reassessment. Manual assignment remains available for exceptions and ad hoc due diligence.

Implementers should define the tier-to-template mapping and score thresholds carefully, since poorly tuned rules can send redundant assessments and burden both the third party and the risk team.

Event-driven rules automate the generation of questionnaires and document requests in response to defined events. Creating them requires, at minimum, the Third-party risk manager role, sn_vdr_risk_asmt.vendor_risk_manager. This role covers configuration of management rules for the application, and its authority is sufficient for building and maintaining the rules.

The Third-party risk admin role, sn_vdr_risk_asmt.vendor_risk_admin, also permits the activity because it inherits manager-level capability, but it is a higher privilege than is necessary and therefore is not the minimum. The assessor role is oriented toward executing and reviewing assessments and does not carry rule configuration rights. The due diligence role is directed at requesting and handling due diligence and is not the role that governs rule creation.

Applying the principle of least privilege, organizations should assign the manager role to the staff who maintain rules and reserve the admin role for application administrators. Doing so limits the risk of unintended changes to automation that generates and dispatches assessments to external parties. Because a misconfigured rule can send requests to many third parties, changes should be tested in a non-production instance and reviewed before activation.

The Request third-party risk due diligence option lets an employee submit a structured request that starts due diligence on a third party or engagement. The supported request types are onboarding a new engagement, reassessing an existing engagement, reassessing an existing engagement for contract renewal, and offboarding an engagement with due diligence. Each type determines the questions the requester answers and the assessment activity that follows.

Duplicating an engagement is a record-management operation and cancelling an engagement is a lifecycle action; neither requests due diligence, so both are excluded. Offboarding without due diligence also exists as a lifecycle path, but it is not offered here because the selection is specific to due-diligence requests.

The value of this design lies in its consistency. A business user who wants to engage a supplier does not need to understand questionnaires or tiering; the request captures context such as the engagement, the products or services involved, and the business owner, and the risk team then drives the assessment. Reassessment variants allow existing relationships to be re-evaluated at renewal without creating duplicate third-party records.

A primary contact adds a colleague through the Manage Team feature of the Third-party Portal by selecting Invite Contact. The action sends an invitation to the colleague, who then becomes a contact on the third-party record and can be assigned questionnaires, tasks or issues. This allows the third party to scale its own response team without involving the customer's administrators.

The other labels, Request Contact, New Contact and Add Contact, are not the names of the action within Manage Team. They describe the intent in general terms but would not appear as the control the primary contact uses. Identifying the correct label matters when preparing user guidance, since screenshots and instructions that cite the wrong action cause confusion for external users.

From a control perspective, only primary contacts have access to team management, which keeps the authority to expand access with a limited group of accountable people. The customer's risk team can still create contacts internally when necessary, for example when a primary contact has left and no one remains to issue invitations.

Implementers should verify that outbound email works and that invitation templates contain the correct portal link and customer name, since invitations are often a contact's first exposure to the process.

The Third-party Risk Issue lifecycle contains states that govern internal analysis and external collaboration. Two of them, Submitted to Third-party and Finalize with Third-party, exist solely to move the issue to the third-party contact for response and then to conclude it with that party. When an issue is intended for internal use only, no external exchange occurs, so those two states can be skipped.

The remaining states carry no such exemption. New is the entry state at which the issue is created, and it cannot be bypassed because every issue must begin there. Analyze is where the assessor evaluates the finding, determines severity and decides on the treatment, which applies equally to internal and shared issues; internal matters still require analysis before being resolved or accepted.

This design allows a single issue model to serve two purposes. Issues relating to internal controls or sensitive observations stay within the risk team, while issues that require evidence or action from the third party flow through the portal. Marking an issue as internal-only at creation determines which path it follows, and it should be set deliberately, since an issue exposed to the third party cannot be recalled in practice.

Using Third-party Risk Management together with GRC or Integrated Risk Management connects external assessment results to the organization's control framework. When a third party gives an unsatisfactory answer to a question mapped to a control objective, the associated control can be marked non-compliant, and that non-compliance feeds into the calculated risk score for the entity. The risk posture therefore reflects control failures that originate from third-party evidence, not only from the assessment score.

The other statements do not describe actual behavior. Primary third-party contacts do not see an internal non-compliant risk score through the portal, since internal control status is not exposed to external parties. Compliance controls are not automatically visible to every third-party risk manager, because visibility remains subject to roles and access. Third-party risk engagements are not automatically matched with audit engagements, as these are different record types governed by separate processes.

In practice this integration gives risk teams a single view in which vendor findings, controls, issues and policy exceptions are linked. It requires that questions are associated with control objectives and that the relevant applications are installed and configured.

Third-party contacts authenticate to the Third-party Portal with credentials stored on their contact record. Two parties are able to change that password. The contact may reset it independently through the Forgot Password link on the portal login page, which is the intended self-service route. A user holding the sys_admin role can also manage the credential, because administrators have authority over user accounts across the platform.

The Third-party Contract Relationship Manager role governs contract and relationship activities and carries no credential-management capability. Likewise the Third-party Risk Reviewer role is oriented toward reviewing assessment results and does not extend to managing user passwords.

This allocation reflects a sound security principle: credential control is limited to the account holder and to platform administration, so business roles cannot alter external access. For support scenarios, a contact who cannot complete the reset process should be referred to an administrator rather than to an assessor or relationship manager.

Administrators should also confirm that the contact record has a valid email address, since the self-service reset relies on it to deliver the reset instructions.

Issues are created from assessment responses after the assessment moves to the Generating Observations state. At this stage the third party has returned its responses, and the assessor reviews them, evaluating answers against expectations. Incorrect or unsatisfactory answers can produce issues, either through automatic generation or when the assessor raises them manually, and the resulting issues can then be managed and shared with the third party as needed.

Issues cannot be created at any time that one question has been answered, since a partially completed assessment has not yet been returned for review and premature issue creation would address incomplete information. The Submitted to Third-party state indicates that the assessment is with the third party for response, so the assessor has no completed responses to evaluate. The Finalizing with Third-party state occurs later, after observations have been generated and the exchange of findings is being concluded, so it is too late to originate issues from the response review.

This ordering ensures that issues are based on complete data and that remediation can be agreed with the third party before the assessment is closed. Assessors should confirm that all required responses and documents have been received before progressing to Generating Observations.

The organization name presented to third-party contacts is controlled by the system property sn_vdr_risk_asmt.company.name. Setting this value replaces the default name wherever the Third-party Portal and its associated communications refer to the organization, so contacts see the correct customer identity when responding to questionnaires and document requests.

The remaining choices are variants that do not match the application's property naming. One omits the vdr segment that identifies the third-party risk scope, another truncates the property so it would not resolve to an existing record, and the last drops the trailing name element, which would describe a different, nonexistent property. Property names must be exact, because a near match creates an unused system property and leaves the displayed name unchanged.

When branding the portal, administrators generally combine this property with portal-level customization such as the logo, theme and page content, which are maintained separately in the portal configuration. Verifying the result by opening the portal as a test contact in a private session confirms the name appears as expected.

In Third-party Risk Management, an element extends the engagement model by representing an external organization on which the third party relies to provide goods, services or support. This allows risk to be assessed beyond the contracted party, covering the dependencies that sit beneath an engagement, commonly described as fourth-party exposure.

Each element is classified, and the classification determines the scoring model applied, which is why elements can be assessed with their own questionnaires and contribute to engagement-level risk.

The other options describe different constructs. The goods, services or support provided by the third party describe the engagement itself, not its elements. Component criteria describe how classifications are evaluated, and are configured on the classification side rather than being the element. Risk areas are the categories into which assessment content and scores are organized and apply to assessments generally; they are not what an element represents.

During implementation, decide which dependencies warrant element records. Capturing every minor subcontractor produces administrative overhead, whereas capturing critical dependencies provides the concentration and resilience visibility that risk managers expect from engagement-level assessments.

Risk management is the process of identifying, assessing and responding to the risks, threats and vulnerabilities that could compromise the business. It is a continuous cycle: risks are identified, their likelihood and impact are analyzed, and a response, whether mitigation, transfer, acceptance or avoidance, is selected and monitored.

The alternatives describe neighboring disciplines. Conforming to standards and policies and remediating audit findings describes compliance management, which concerns adherence to requirements rather than the evaluation of exposure. Eliminating vulnerable surface area describes a technical hardening activity, a possible response to a risk but not the discipline itself; moreover, elimination of all exposure is rarely achievable or economical. Establishing policies, standards and procedures aligned to corporate strategy describes governance, which sets direction and expectations within which risk management operates.

Third-party risk management applies the same cycle to external relationships. The organization identifies the risks introduced by each supplier or partner, assesses them through questionnaires and evidence, and responds through issues, tasks, exceptions or termination. Understanding this definition is foundational, since the application's tiering, assessment and remediation features map directly to the identify, assess and respond stages.

Contacts use the Third-party Portal to complete assessments and to manage assessment deadlines. Completing assessments encompasses answering questionnaires, uploading requested documents and submitting responses. Managing deadlines is supported because the portal displays outstanding items with their due dates, which lets the contact prioritize work and respond before reminders escalate.

The portal does not provide general project management. Its scope is limited to risk assessment interactions, namely questionnaires, document requests, issues and tasks assigned by the customer, and it offers no planning, scheduling or resource tools beyond those items. Hosting web meetings is a function of conferencing applications and is outside the capabilities of the portal. Where discussion is required, the interaction occurs through comments and responses recorded on the relevant record, which has the advantage of being retained with the assessment.

For implementation, communicate to third-party contacts exactly what the portal is for. Setting this expectation reduces support requests that stem from contacts seeking features it was never designed to provide, and it focuses the interaction on completing the assessment within the due date.

Within a metric category, each assessment metric is scored, and the individual scores are rolled up into a category score expressed on a normalized scale of 0 to 100. The same scale applies to the scores of categories and to the resulting assessment and risk scores. A common range allows scores from different categories and assessments to be combined, compared and measured against thresholds.

Narrower ranges such as 0 to 5, 0 to 10 or 0 to 20 are not the convention for the roll-up. Individual metrics may have their own response weightings, but they are normalized when aggregated, which makes the category result comparable regardless of the number of questions or the weights of each.

The practical significance is in rating configuration. Risk rating thresholds, for example the boundaries separating low, moderate and high risk, are defined against the normalized scale, and category weights determine how each category contributes to the assessment score. Misunderstanding the scale leads to poorly set thresholds and ratings that do not reflect the organization's tolerance.

When designing questionnaires, assign metric weights thoughtfully, review category weights for balance, and test sample responses to confirm that the resulting scores and ratings behave as intended before releasing the template for production use.

The scoped Third-party Portal is reached by appending the /svdp endpoint to the instance URL. The value is defined by the system property sn_vdr_risk_asmt.vendor_portal_endpoint, and its default of svdp corresponds to the application scope for the portal. A contact would therefore browse to the instance address followed by /svdp to reach the login and landing page.

The other values are not baseline endpoints. The abbreviations /tpp and /tpvp resemble plausible third-party portal names but are not defined by default, and /svp omits the d that identifies the vendor-derived scope name. Using a nonexistent suffix returns a page-not-found result for the contact, which commonly generates support requests after go-live.

Administrators may change the property to align the URL with corporate naming conventions, but any change must be communicated to contacts and reflected in notification templates that embed the portal link. Because the portal URL appears in invitations and reminders, the property should be finalized before large-scale invitations are issued.

When troubleshooting access, verify the property value first, then the contact's account status and role assignment.

Risk intelligence reports are ordered from external providers through the risk intelligence capability of Third-party Risk Management. Two configuration items gate the request. First, the provider record must have the Order reports option enabled; without it, the provider is treated as a source of scores or data only and cannot be selected when requesting a report. Second, a risk intelligence request type must exist for that provider, because the request type defines which report is available and populates the report selection on the request form.

Downloading a sample report is an optional reference step and does not enable ordering. The sanctioned-report field is not a prerequisite for requesting reports, and the copyright agreement setting on the request form is not a configuration action that must be completed beforehand.

In practice, an administrator registers the provider, enables ordering, and then defines request types that match the provider's catalog of reports. Only then will users with the appropriate role see the report as requestable from the third-party record, and the resulting report can be attached to the third party for use in assessments and reviews.