When evaluating a third party's Security and Privacy Awareness Program, the primary focus is on its effectiveness and ability to mitigate human-related risk. The content of the training, the frequency of its delivery, and the mechanisms for tracking completion and comprehension are all critical indicators of a program's maturity and success. The specific brand or vendor of the Learning Management System (LMS) or training platform is the least important factor. An effective program can be delivered using various tools, and the choice of vendor does not inherently determine the program's quality or impact on employee behavior. The outcome, not the tool's brand name, is the key concern for the assessor.

A. The content and topics covered in the training materials.

Content is crucial; it must be relevant to the organization's risks, industry regulations, and the specific roles of employees to be effective.

C. The methods used to track training completion and test understanding.

Tracking is essential for demonstrating compliance, ensuring the entire workforce is trained, and measuring the program's reach and basic effectiveness.

D. The frequency of training and awareness communications.

Regular, ongoing training and communication are vital to reinforce security principles and maintain a high level of awareness against evolving threats.

1. Shared Assessments Standardized Information Gathering (SIG) Questionnaire: The SIG is a foundational tool for the CTPRP. In the Human Resources Security domain (e.g., Section C in the 2023 SIG Core), questions focus on whether training is provided, its frequency (annually, upon hire), the topics covered (e.g., phishing, data handling), and if completion is tracked (C.1.1 - C.1.4). The questionnaire does not ask for the specific vendor of the training platform, demonstrating its lower importance in the assessment process.

2. Shared Assessments Certified Third Party Risk Professional (CTPRP) Body of Knowledge: The CTPRP curriculum emphasizes evaluating the substance and outcomes of a control. For awareness programs, this means assessing the risk reduction achieved through employee education. The focus is on the program's design, implementation, and measurement, rather than the specific commercial tools used for delivery. The effectiveness of the control is paramount.