Document library
The working artifacts from The Future of Third-Party Risk Management & Data Privacy, numbered as the book numbers them. Each entry notes what the document is for and the chapter that explains how to use it. Where two versions exist, the annotated version explains the intent behind each clause and the execution version is clean and ready to adapt. Click any artifact, or its Read link, to open it in your browser; the Word and Excel links download an editable copy.
Current versions, last updated October 2026. These are starting points, not legal advice; tailor them to your organization and have counsel review anything you intend to sign.
| No. | Artifact | Use it to | Chapter | Read or download |
|---|---|---|---|---|
| 01 | Information Technology Checklist (ITC) | Scope a vendor before you assess it: the service, the data, the access, and any AI in play. | Ch. 3, 5 | Read Word |
| 02 | Vendor Questionnaire Framework | Build questionnaires that scale with vendor tier, service type, and data sensitivity. | Ch. 5 | Read Word |
| 03 | Maturity Assessment Rubric | Score your program across nine dimensions and five levels, then build the roadmap. | Ch. 16 | Read Word |
| 04 | Regulatory Reference Guide | See the key regulations and what each one actually requires of vendor oversight. | Ch. 2 | Read Word |
| 05 | Tabletop Exercise Template | Run vendor-failure scenarios with your team before a real one runs you. | Ch. 9, 14, 18 | Read Word |
| 06 | Contract Review Checklists | Review IT security addendums and data protection agreements clause by clause. | Ch. 4 | Read Word |
| 07 | RACI Matrix Template | Map who does what across the vendor lifecycle, and who owns each risk decision. | Ch. 13 | Read Word |
| 08 | DPIA / PIA Template | Run data protection and privacy impact assessments inside the vendor lifecycle. | Ch. 10 | Read Word |
| 09 | Master Services Agreement Annotated and execution versions | Anchor the vendor relationship with security, privacy, and AI obligations built in. | Ch. 4 | Annotated: Read Word Execution: Read Word |
| 10 | IT Security Addendum Annotated and execution versions | Lock specific, enforceable security obligations into the contract. | Ch. 4 | Annotated: Read Word Execution: Read Word |
| 11 | AI Acceptable Use Policy Annotated and execution versions | Govern how employees and vendors may use AI tools, before shadow AI decides for you. | Ch. 11 | Annotated: Read Word Execution: Read Word |
| 12 | AI Audit Questionnaire | Assess a vendor’s AI systems: training data, drift, explainability, and controls. | Ch. 11 | Read Excel |
Found an error, or a regulation that has moved on since the last update? The documents improve the same way the book did: practitioners pointing at the gap. Write to norman.levine@cyberriskpartnersllc.com.