Third-party Risk Management

The ServiceNow® GRC: Third-party Risk Management (TPRM) application enables you to proactively identify, assess, and mitigate risks that are associated with your third-party relationships. TPRM provides a centralized process for managing your portfolio of third parties, assessing and scoring risk, and performing remediation.

Get started

Visit the ServiceNow Store website to view all the available apps and for information about submitting requests to the store. For cumulative release note information for all released apps, see the ServiceNow Store version history release notes.

Explore [Omitted image "bus-explore.svg"] Alt text:Learn about how third-party risk managers, third-party risk users, and third-party risk administrators use the Third-party Risk Management application.	Configure [Omitted image "bus-sdlc.svg"] Alt text:You can activate or upgrade TPRM, by downloading the applications from the ServiceNow Store and then configuring the settings to meet your needs.	Integrate [Omitted image "bus-integration-and-apis.svg"] Alt text: Extend TPRM capabilities by integrating with other applications.
Migrate Classic to Smart Assessment Engine [Omitted image "bus-case-and-knowledge-management.svg"] Alt text:Learn what changes when you migrate from the Classic Assessment Engine to the Smart Assessment Engine, including feature differences, limitations, and setup requirements.	Request third-party risk due diligence [Omitted image "bus-partnering.svg"] Alt text:Request third-party risk due diligence to determine the level of risk for interactions with a third party and their engagement.	Assess third-party risk [Omitted image "bus-discover.svg"] Alt text:Use Third-party Risk Management to identify and assess potential risks that are associated with your third-party relationships.
Monitor third-party risk [Omitted image "bus-try-a-demo.svg"] Alt text:Use the Third-party Risk Management application to monitor potential risks associated with your third-party relationships.	Approve or reject requests for due diligence [Omitted image "bus-handshake.svg"] Alt text:Set up the approval levels and rules for due diligence requests in the Third-party Risk Management application to use while approving or rejecting requests after reviewing questionnaire responses and due diligence process results.	Manage the contract risk process [Omitted image "bus-contract.svg"] Alt text:Protect your organization's interests, as the Third-party risk contract negotiator by incorporating specific contractual provisions so that you can address identified risks.
Use Digital resilience third-party registers [Omitted image "bus-dollar-sign.svg"] Alt text:Use the Digital resilience third-party registers application in the Vendor Management Workspace to set up and maintain registers of contractual arrangements with ICT third-party service providers.	Use risk intelligence reports[Omitted image "bus-threat-intelligence-source.svg"] Alt text:Manage and request risk Intelligence reports or scores from external risk intelligence content providers.	Integrate scores from risk intelligence providers[Omitted image "bus-integration-and-apis.svg"] Alt text:Integrate scores from risk intelligence providers. The scores provide insight on how trustworthy and safe a particular third party can be.
Use the third-party portal[Omitted image "bus-service-portal.svg"] Alt text:Use the third-party portal to respond to questionnaires, requests for documentation, tasks, and issues. The portal is the point of interaction between third-party contacts and risk assessors.	Reference[Omitted image "bus-learn.svg"] Alt text:Reference topics provide detailed descriptions of tables, properties, forms, and roles that are installed with the Third-party Risk Management application.

**Important:**

The Vendor Management Workspace for ITSM (sn_itsm_vendor) is deprecated as of the Australia release. It is hidden and no longer available for activation for new customers. References to Vendor Management Workspace throughout this documentation refer to the GRC: Vendor Management Workspace (sn_vrm_ws), which is a separate application included with Third-party Risk Management and is not affected by this deprecation. For details about the deprecation process, see the Deprecation Process [KB0867184] article in the Now Support Knowledge Base.