🔵 Free Advisory: Supply Chain & Vendor Risk — What Auditors Look For in 2026

​Supply chain risk is the fastest-growing category of audit findings — and most compliance programs are not built to handle it.

​In 2026, auditors are asking harder questions about vendors, subprocessors, and fourth-party risk than ever before. SOC 2 assessors, ISO 27001 certification bodies, and NIST-aligned programs are all tightening their expectations. If your vendor risk program was built to pass last year's audit, it may not pass this year's.

​In this free one-hour session, I'll walk through exactly what auditors are looking for in supply chain and vendor risk programs right now — and where most organizations fall short.

​What we'll cover: — The vendor risk findings showing up most in 2026 audits — What "adequate" vendor oversight actually looks like to an auditor — The subprocessor and fourth-party questions you're probably not ready for — How to update an existing vendor risk program without rebuilding it — What evidence you need — and in what format

​No slides. No pitch. Just the real picture of where auditor expectations have moved.

​Who this is for: CISOs, GRC managers, and security professionals who have a vendor risk program but aren't sure it would hold up to scrutiny — especially if you're heading into a SOC 2 renewal, ISO 27001 surveillance audit, or a new enterprise client security review.

​This session leads into Module 4 of the GRC Builder Series — Incident Response and Metrics — coming in August.

​Hosted by Meenu Chadha — founder of Cyber Advisory and fractional vCISO.

​FREE. Virtual. One hour. Register above.