{"catalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","download":{"releaseId":"sha256:29345aeb9c29390bfdd45bf0ec2cfd311b20a53c4eeac46f1446966ce210337e","slug":"reg-third-party-ict-vendor-assurance","url":"/controls/assets/agent_workflow-reg-third-party-ict-vendor-assurance-e12b79cb.5dbfa5830705a5a3.json"},"kind":"record","record":{"attributes":{"department":"procurement","domain":"reg","lineOfDefense":"monitor"},"canonicalUrl":"https://assureswarm.com/workflows/all/?w=reg-third-party-ict-vendor-assurance","description":"Third-Party ICT Vendor Regulatory Assurance as a decision-aware workflow. Each cycle runs on its own Audit engagement item (audit_type = vendor_review) created at kickoff, with Audit.scope set to the in-scope legal entities, regimes, and vendor population; every workpaper, decision form, and gap attaches to that instance. In scope: ICT third-party service providers — including intra-group ICT providers — assessed against DORA, NIS2, and US interagency/FFIEC third-party expectations; out of scope: non-ICT vendors, which stay with the general vendor lifecycle. It consumes the arrangement-level inventory, tiering, and due-diligence handoff package from Third-Party Vendor Risk Lifecycle (whose provider records are the Vendor items); refers vendor SOC 1/SOC 2 reports carrying real reliance to the Vendor SOC 1/SOC 2 Report Review & CUEC Mapping workflow and folds back its reliance conclusions; and produces a provision-cited, severity-rated gap register (Issue items linked to the anchor Audit and the affected Control/Vendor records) plus a qualified final assurance package. It hands the validated obligation statuses to the Regulatory Compliance Attestation Cycle, exchanging handoff packages with related workflows instead of duplicating repeated work.","details":{"canonicalUrl":"https://assureswarm.com/workflows/all/?w=reg-third-party-ict-vendor-assurance","capabilities":[],"controls":["UC-TPRM-01","UC-TPRM-04","UC-ASSET-05","UC-LOG-09","UC-TPRM-05","UC-TPRM-06"],"domains":["reg"],"lineOfDefense":"monitor","mappingStatus":"mapped","releaseId":"sha256:29345aeb9c29390bfdd45bf0ec2cfd311b20a53c4eeac46f1446966ce210337e","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:reg-third-party-ict-vendor-assurance","standards":["dora","nis2"],"teams":["procurement","compliance-legal"]},"id":"wf:R6","mapUrl":"https://assureswarm.com/controls/?v=1&node=wf%3AR6","slug":"reg-third-party-ict-vendor-assurance","sourceIds":["aiuc-1","cobit-2019","dora","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500"],"sourceUrl":null,"title":"Third-Party ICT Vendor Regulatory Assurance","type":"workflow"},"relationships":[{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:31568ab19606852875865ba961cec39ec0856b3bd2b22a3694bdbd7d5927c900","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-01-16b62053.json","targetId":"uc:UC-TPRM-01","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:3dbf1faba31192e4d2aff6be799b992b03f5ea2762d01f60ef51ecc5978f72db","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/controls/data/v1/records/uc-uc-asset-05-11852f6d.json","targetId":"uc:UC-ASSET-05","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:427213dbb05eb996893397ffe80d1d32fdfa3a2bf8f1b2fee3e7ccbf99ea72c0","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/controls/data/v1/records/uc-uc-log-09-54136146.json","targetId":"uc:UC-LOG-09","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:669a6e122977861115741614acfeae0b9d974a61980b3e748fe8c1b606857875","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-06-0d2c1b90.json","targetId":"uc:UC-TPRM-06","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:c65489ffc767d71a5ae1a8a67249acca7a5905306cf4866b13edf9783069d300","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-05-039b6350.json","targetId":"uc:UC-TPRM-05","type":"oversees"},{"expectedCatalogRevision":"f368a6cce277037e4b1e1ff46004e3acd295f96c9ac63a411a0e45775a7f468e","id":"rel:d26581abe3d46f172ea9ca142974efef5f7f7b32914c71a5944100c0680ea487","properties":{},"sourceDetailPath":"/controls/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/controls/data/v1/records/uc-uc-tprm-04-e6aef252.json","targetId":"uc:UC-TPRM-04","type":"oversees"}],"schemaVersion":1}