One discipline, whole
See the whole lifecycle
Intake, tiering, due diligence, contracting, monitoring, offboarding. Every vendor passes through all six stages, and every gap between them is where breaches live.
Govern vendor AI
Model risk, training data, drift, agentic systems, and the EU AI Act timetable, treated as part of vendor risk rather than a separate conversation.
Run it like an operation
Monitoring that triggers action, issues that actually close, metrics leadership uses, and the organizational muscle to keep it all working.
“Your security is only as strong as your least-secured vendor’s access.”
From the practice, not the podium
Norman J. Levine has spent his career inside the work this book describes: running third-party risk programs at Fortune 500 companies including Omnicom, Cigna, and Stanley Black & Decker, consulting with KPMG, and holding the CISA and CDPSE credentials. The frameworks here were not designed on a whiteboard. They were tested on live portfolios.
The tools are free. Take them.
Twelve working artifacts from the book, the Information Technology Checklist, the maturity rubric, annotated contract templates, the AI audit questionnaire, and more, hosted here so they stay current as regulation moves. Browse the document library.