{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","download":{"releaseId":"sha256:b4c06cb6a2ba39ca07accbded09c9f8aedbc921ced294ee70b6041ac580956fa","slug":"reg-third-party-ict-vendor-assurance","url":"/assets/agent_workflow-reg-third-party-ict-vendor-assurance-e12b79cb.cacef97798bcc8bf.json"},"kind":"record","record":{"attributes":{"department":"procurement","domain":"reg","lineOfDefense":"monitor"},"canonicalUrl":"https://workflow-library.com/all/?w=reg-third-party-ict-vendor-assurance","description":"Third-Party ICT Vendor Regulatory Assurance as a decision-aware workflow. Each cycle runs on its own Audit engagement item (audit_type = vendor_review) created at kickoff, with Audit.scope set to the in-scope legal entities, regimes, and vendor population; every workpaper, decision form, and gap attaches to that instance. In scope: ICT third-party service providers — including intra-group ICT providers — assessed against DORA, NIS2, and US interagency/FFIEC third-party expectations; out of scope: non-ICT vendors, which stay with the general vendor lifecycle. It consumes the arrangement-level inventory, tiering, and due-diligence handoff package from Third-Party Vendor Risk Lifecycle (whose provider records are the Vendor items); refers vendor SOC 1/SOC 2 reports carrying real reliance to the Vendor SOC 1/SOC 2 Report Review & CUEC Mapping workflow and folds back its reliance conclusions; and produces a provision-cited, severity-rated gap register (Issue items linked to the anchor Audit and the affected Control/Vendor records) plus a qualified final assurance package. It hands the validated obligation statuses to the Regulatory Compliance Attestation Cycle, exchanging handoff packages with related workflows instead of duplicating repeated work.","details":{"canonicalUrl":"https://workflow-library.com/all/?w=reg-third-party-ict-vendor-assurance","capabilities":[],"controls":["UC-TPRM-01","UC-TPRM-04","UC-ASSET-05","UC-LOG-09","UC-TPRM-05","UC-TPRM-06"],"domains":["reg"],"lineOfDefense":"monitor","mappingStatus":"mapped","releaseId":"sha256:b4c06cb6a2ba39ca07accbded09c9f8aedbc921ced294ee70b6041ac580956fa","roleIntegrity":{"activityCount":0,"ermPhases":[],"lineRoles":[],"serviceModes":[],"warnings":[]},"sourceTemplateId":"workflow-library:reg-third-party-ict-vendor-assurance","standards":["dora","nis2"],"teams":["procurement","compliance-legal"]},"id":"wf:R6","mapUrl":"https://controlsmap.com/?v=1&node=wf%3AR6","slug":"reg-third-party-ict-vendor-assurance","sourceIds":["aiuc-1","cobit-2019","dora","iso-27001","nis2","nist-800-53","nist-csf-2","nydfs-500"],"sourceUrl":null,"title":"Third-Party ICT Vendor Regulatory Assurance","type":"workflow"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:31568ab19606852875865ba961cec39ec0856b3bd2b22a3694bdbd7d5927c900","properties":{},"sourceDetailPath":"/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/data/v1/records/uc-uc-tprm-01-16b62053.json","targetId":"uc:UC-TPRM-01","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3dbf1faba31192e4d2aff6be799b992b03f5ea2762d01f60ef51ecc5978f72db","properties":{},"sourceDetailPath":"/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/data/v1/records/uc-uc-asset-05-11852f6d.json","targetId":"uc:UC-ASSET-05","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:427213dbb05eb996893397ffe80d1d32fdfa3a2bf8f1b2fee3e7ccbf99ea72c0","properties":{},"sourceDetailPath":"/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/data/v1/records/uc-uc-log-09-54136146.json","targetId":"uc:UC-LOG-09","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:669a6e122977861115741614acfeae0b9d974a61980b3e748fe8c1b606857875","properties":{},"sourceDetailPath":"/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/data/v1/records/uc-uc-tprm-06-0d2c1b90.json","targetId":"uc:UC-TPRM-06","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:c65489ffc767d71a5ae1a8a67249acca7a5905306cf4866b13edf9783069d300","properties":{},"sourceDetailPath":"/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/data/v1/records/uc-uc-tprm-05-039b6350.json","targetId":"uc:UC-TPRM-05","type":"oversees"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d26581abe3d46f172ea9ca142974efef5f7f7b32914c71a5944100c0680ea487","properties":{},"sourceDetailPath":"/data/v1/records/wf-r6-824a647c.json","sourceId":"wf:R6","targetDetailPath":"/data/v1/records/uc-uc-tprm-04-e6aef252.json","targetId":"uc:UC-TPRM-04","type":"oversees"}],"schemaVersion":1}