Engineering vendor contracts at Nordhaven Bank, a European bank with 2,400 vendors and 90 critical ICT providers under DORA: a cloud provider contract that only promised to comply with applicable law, rebuilt with the Article 30 audit, access and exit provisions; the eight-station contract rail running down a contract from obligation sourcing and the security schedule through clause engineering, negotiation, fourth-party chains, monitoring and enforcement to evidence; and the payroll vendor breach where a vague prompt-notification clause let the vendor report 11 days late, rewritten as a 24-hour notice duty flowed down to the hosting subcontractor and enforced with a logged remedy.

CY-EXPERT-023Expert Level · Third-Party Risk

Third-Party Contract Controls Defensibility — The Contract Rail

An expert-level course that engineers vendor contracts so their security provisions actually flow down regulatory obligations, are testable and enforceable, are monitored against real controls, are enforced on incident and exit, and can be evidenced to a regulator.

18 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Trace applicable regulation (DORA, GDPR, NIS2, sector rules) to the specific contractual duty it requires, tiered by vendor criticality.
Engineer clauses that state a measurable requirement, a testing method, and the evidence expected, eliminating vague assurance language.
Flow security and notification obligations down through subcontractor and fourth-party chains, and monitor concentration risk.
Build a contract evidence pack and a living register of information that are defensible under direct regulatory questioning.

Price:৳12,000