Assuring Vellora Therapeutics' SaaS vendors through an eight-stage assurance funnel — portfolio and charter, tiering, due diligence, contract, onboarding, monitoring, incident and exit, and metrics — that takes a spreadsheet of 150 apps to more than 900 discovered and tiers each by its data; a SOC 2 report actually read, catching a scope that covered the wrong subsidiary, three exceptions on page 41 and a user-entity control for MFA that Vellora now enforces; and the gaps the program catches, from a vendor breach heard about five weeks late to an over-scoped OAuth grant, a leaver's lingering account, a quiet AI feature and an unused app still connected.

CY-SENIOR-109Senior Level · SaaS Vendor Assurance

SaaS Vendor Assurance Program — The Assurance Funnel

A senior-level GRC program course that builds and runs the assurance program covering your own SaaS vendors - discover the full portfolio, tier by inherent risk, actually read due-diligence evidence, negotiate enforceable security schedules, assure onboarding and integration, monitor continuously, handle vendor incidents and exit, and report honest program metrics. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Discover the full SaaS portfolio and charter the assurance program with a cross-functional RACI.
Tier every application by inherent risk and let tier drive proportionate assessment depth.
Read and validate SOC 2, ISO 27001, and CAIQ evidence, and negotiate an enforceable security schedule.
Assure onboarding, integration, and continuous monitoring, and handle vendor incident, exit, and program reporting.

Price:৳10,000