CIS-TPRM Exam Guide: Domain Weights, Cost and Study Plan

With four hundred suppliers on the list and time to assess only forty this quarter, who goes first? Answering that well is most of what the ServiceNow Third-party Risk Management implementation exam checks. The credential, CIS-TPRM, has 60 questions in 90 minutes, costs USD $450 and is reported Pass or Fail. Its heaviest area, a third of the blueprint, is how assessments are built and scored.

Who gets assessed first when a supplier list runs to hundreds of names?

The honest answer is: not everyone, and not in the order they arrived. A risk team cannot send a long due diligence questionnaire to every supplier every year. It sorts suppliers into tiers, so that a payment processor holding customer data gets a deep review while a company that supplies office plants gets a short one, or none. ServiceNow's Third-party Risk Management application, often shortened to TPRM, turns that sorting into configuration. A candidate who understands why the tiers exist will find the exam's assessment questions far easier than one who has only memorised menu names.

That is why this guide starts with the scenario rather than the exam fees. Every domain in the blueprint is a step in the same story. A third party is added to a portfolio, its contacts are recorded, it is tiered, an assessment goes out, the third party answers through a portal, the answers are turned into a score, problems become issues, and the result flows into the wider governance, risk and compliance work the organisation already does. The exam asks you to configure, implement and maintain each step, and its questions usually describe a requirement and ask which setting or design satisfies it.

The credential was formerly known as the vendor risk management specialist exam, and ServiceNow's own credential page still sits at an address containing the older name. You may see both names in job adverts, training catalogues and forum posts. They refer to the same family of work: assessing and monitoring the companies your organisation depends on. The name changed to reflect that the risk does not come only from vendors that sell goods; it comes from any outside party with access to your data, systems or operations.

Who is this exam written for?

The exam suits people who will help put the application into production for a customer or an internal team. That includes ServiceNow implementation consultants adding GRC to their repertoire, platform administrators asked to take over a vendor risk rollout, and risk or procurement analysts who have started configuring the tool rather than just using it. It is an implementation exam, not a risk theory exam. You should know what a risk tier is, but the questions will ask how to configure tiering, not to debate whether a particular supplier is high risk.

What are you signing up for before you book a seat?

Before any studying, fix the facts in your mind. The table below sets them out. ServiceNow can revise its exams between releases, so treat its credential page for the Third-party Risk Management implementation specialist exam as the final word and read it on the day you book.

Detail	CIS-TPRM
Full name	ServiceNow Certified Implementation Specialist - Third-party Risk Management
Exam code	CIS-TPRM
Category	Technology
Number of questions	60
Duration	90 minutes
Exam fee	USD $450
Passing score	Pass / Fail
Booking	Through the scheduling page ServiceNow links for its exams

Two practical points follow from the table. First, 90 minutes for 60 questions gives you an average of ninety seconds a question. Scenario questions take longer than that and definition questions take less, so the average only works if you move quickly through the easy ones. Second, the result is Pass or Fail with no published numeric cut-off, so you cannot study to a percentage. The only trustworthy readiness signal is how you perform on timed practice and whether you can explain why each wrong option is wrong.

Prerequisites and voucher rules are worth checking early, because ServiceNow ties some exam access to its own training. The credential page and your ServiceNow University account show what applies to you. This article does not repeat training-provider claims about prerequisites, since those change and are not the vendor's own words. Certification training is also separate from the exam fee, so budget for both if you do not have a learning entitlement.

A note on freshness. When this exam was checked in October 2026, public listings still showed it as a current ServiceNow credential, with an active learning path on ServiceNow University, and we found no retirement notice. ServiceNow's own pages load their detail only for signed-in or script-enabled browsers, so please confirm the live question count and any version change on the credential page before you pay. At least one third-party practice-test seller describes a shorter assessment of its own, which is a separate product and not the ServiceNow exam; this article follows the 60-question format.

Why does one domain hold a third of the whole blueprint?

The published exam weightings are the most useful planning tool you have, and they are lopsided. Assessment Configuration is worth 33 percent, the largest single share. Fundamentals and review follow at 23 percent. After that, Core Configuration carries 14 percent, the Third-party Portal 12 percent, Third-party Supporting Processes 12 percent, and Other Application Relationships 6 percent. The six figures add up to 100.

Blueprint domain	Weight	What it is really testing
Assessment Configuration	33%	Due diligence requests, tiering, risk calculation and the assessment lifecycle
Fundamentals and Review	23%	Risk concepts, the process end to end and how the application is built
Core Configuration	14%	Portfolio setup, contacts and intelligence scoring
Third-party Portal	12%	What third parties see and do when they respond
Supporting Processes	12%	Approvals and the automation around the main flow
Other Application Relationships	6%	How TPRM connects to other GRC products

Read the table as a study budget. If you spread your hours evenly across six domains you will over-invest in the smallest and under-invest in the largest. A sensible split gives roughly a third of your time to assessments, a quarter to fundamentals, and shares the rest in proportion. The small domains still matter, because a candidate who knows nothing about application relationships gives away marks that cost very little to earn.

The weights also tell you something about the exam's temperament. Because assessment configuration dominates, many questions are about design decisions with several moving parts: a tier, a questionnaire, a scoring rule and a due date interacting. You will rarely be asked a lone fact. Plan to practise combining ideas, not just learning them in a list.

What does each of the six domains expect you to configure?

The following walk-through follows the order of importance rather than the order of the table above. Where this article describes a feature in general terms, check the product documentation for the release your customer runs, because screen names and field labels shift between versions.

Assessment Configuration: the domain that decides the result

This domain covers assessment basics and due diligence requests, tiering frameworks, risk calculations and lifecycle management. Treat it as four linked questions. What do we need to learn from a third party? Which third parties need which depth of review? How do answers become a risk number? And what happens to an assessment from the day it is created until the day it is closed?

Start with the questionnaire idea. An assessment asks structured questions, and the answers feed a score. You should be comfortable with how a template defines the questions, how respondents are chosen, and how deadlines and reminders keep an assessment moving. Then move to tiering. Tiering uses information about a third party, such as the type of data it touches, how critical the service is and how large the spend, to decide how much scrutiny it deserves. Know what feeds a tier, what a tier changes downstream, and why a change in a third party's circumstances should lead to re-tiering.

Risk calculation is the third strand. Answers carry weight, the weights combine into a score, and the score maps to a rating that people can act on. The exam wants you to reason about why a particular question should count more than another and what would distort a score if a rule were set carelessly. Lifecycle management completes the domain: what states an assessment passes through, who acts at each state, and how reassessment is triggered rather than left to memory.

Fundamentals and Review: the vocabulary and the shape of the process

Nearly a quarter of the exam checks that you understand third-party risk as a discipline and the application as a system. Expect questions on why organisations assess third parties, what kinds of risk matter (security, financial, operational, compliance and reputational), and the stages of the lifecycle from onboarding through ongoing monitoring to offboarding. The technical side asks how the application stores third parties, how it relates to other platform records, and who does what in a typical implementation.

This is the domain where a risk professional has a head start and a pure administrator may feel shaky. If you come from the platform side, read an introduction to third-party risk before you read configuration guides. If you come from the risk side, the reverse applies: learn the platform's records and roles before you assume the tool behaves like a spreadsheet.

Core Configuration: the portfolio, the contacts and the scores that arrive from outside

Core Configuration is portfolio setup, contact management and intelligence scoring. The portfolio is the list of third parties the programme covers, and the exam asks how it is populated and kept accurate. Contacts matter more than they first appear, because every assessment, reminder and portal invitation depends on reaching the right person at the third party. Intelligence scoring brings in outside data about a third party's posture so that the internal view is not built on questionnaire answers alone. Study how those scores are brought in, how they sit beside assessment results, and what a team should do when they disagree.

Third-party Portal: the supplier's side of the screen

Twelve percent of the exam is about the interface that third parties use. The key idea is that a respondent is not a platform user in the ordinary sense. They should see only what they need to answer, upload evidence and track their own requests. Questions here ask who can be invited, what they can reach and how the portal is configured for a given programme. Think about it from the supplier's point of view: if a request is unclear or arrives at the wrong inbox, no configuration setting will rescue the assessment.

Third-party Supporting Processes: approvals and automation

Supporting processes cover approval workflows and the automation that carries work between steps. Typical examples are an approval before a high-risk third party is onboarded, or a task raised when an assessment answer reveals a gap. The exam checks that you can choose the right mechanism for a requirement, and, importantly, that you know when to configure rather than customise. Platform best practice favours configuration, and options that rewrite core behaviour tend to be the distractors.

Other Application Relationships: the link to the rest of GRC

The smallest domain asks how TPRM interacts with other governance, risk and compliance applications on the platform, such as risk registers and compliance monitoring. It is a small slice, so aim for the principle: findings about a third party should connect to the organisation's risks and controls instead of living in a separate silo. Read the product documentation for the integration points and learn which direction data flows.

How does one assessment travel from request to risk score?

Abstract lists are easy to forget, so trace one example from end to end. Imagine a hospital group onboarding a cloud billing provider. Each step below maps to a domain in the blueprint, and each is the sort of situation an exam question will describe.

1. The third party is recorded. The billing provider is added to the portfolio with a business owner and named contacts. If the contact list is wrong, nothing later works.
2. It is tiered. The provider will hold patient billing data and the service is critical, so the tiering rules place it in the highest tier. A stationery supplier would land in the lowest.
3. A due diligence request is raised. The tier decides which template is used. The top tier receives the long questionnaire, evidence requests and a short deadline.
4. The provider responds through the portal. Its security lead answers the questions and uploads a recent audit report. Nobody at the provider needs a full platform account.
5. Answers are scored. Weighted questions combine into a risk score, and external intelligence about the provider is read alongside it. If the two disagree, a reviewer decides which to trust and records why.
6. Gaps become issues. A missing incident response test is logged, assigned and given a due date, and an approval is required before onboarding goes ahead.
7. The result joins the wider picture. The finding is visible to the teams managing enterprise risk and compliance, and the provider is scheduled for reassessment.

Now test yourself by changing one fact. What if the provider's circumstances change after a year, say it begins processing a new kind of data? The tier should be reviewed, a fresh assessment triggered, and the old score treated as out of date. Scenario questions on the exam are built exactly like this: a small change in the facts, and a request to name the capability that deals with it.

Where candidates often confuse neighbouring ideas

A few pairs of ideas look alike and are easy to swap under time pressure. A tier is a category that decides how deep the review goes; a risk score is the outcome of the review. An assessment is the questionnaire sent to a third party; an issue is a problem raised because of an answer. A contact is someone at the third party; a user is someone inside your organisation. Writing each pair on one line of your revision notes pays back quickly, since wrong options on this exam often exploit exactly these near-synonyms.

What should a third party see, and what should stay hidden?

The portal domain looks small but it invites a reasoning pattern that appears across the exam: least access. A third party should reach only its own assessments and requests, and nothing about other suppliers or your internal scoring logic. When a question asks how to let an outside party respond without exposing internal data, the correct option is almost always the one that limits scope, not the one that grants a broader role for convenience.

Apply the same instinct to approvals and notifications. An email that tells a supplier an assessment is overdue is useful; an email that reveals the internal risk rating is not. If you can state, for each portal feature, who benefits and what could leak, you will find distractor options easy to eliminate.

It also helps to read the platform's own explanation of the application in the ServiceNow product documentation. The documentation describes roles, records and configuration options in the words the exam uses, which matters when two answer choices differ by a single term. Search it for the third-party risk management section that matches the release your preparation course used.

What does a four-week plan look like for someone new to TPRM?

The plan below assumes about an hour and a half on weekdays and a longer session at the weekend. If you already run a TPRM programme, compress it to two weeks and skip the first week's fundamentals. If you are new to both risk and the platform, stretch it to six.

Week	Focus	Finish the week able to
1	Fundamentals and core configuration	Describe the lifecycle, set up a portfolio, explain contacts and intelligence scores
2	Assessment configuration, part one	Explain tiering inputs, templates, due diligence requests and who answers what
3	Assessment configuration, part two, plus the portal	Walk a risk calculation, a lifecycle and a portal invitation without notes
4	Supporting processes, relationships and practice	Score at a steady level on two timed sittings and explain every miss

Week one: read the process before the screens

Spend the first days on concepts. Write a one-page description of the third-party lifecycle in your own words, then compare it with the application's records. By the end of the week you should be able to describe the six domains from memory and say which ones you find hardest. Then do the portfolio and contact work, because every later exercise depends on a clean list of third parties.

Weeks two and three: spend the money domain's hours

Give assessments twice the time of any other topic. Build, on paper or in a sandbox, a tiering rule, a questionnaire and a scoring approach for an imaginary supplier set, then change one input and predict the consequences. If your instance has the application, do this hands-on. TPRM is a licensed GRC application and a free personal developer instance may not include it, so confirm what your environment offers; if it does not, rely on the course labs, the documentation and written walk-throughs, and be strict about explaining each step aloud.

Week four: practise under the clock

Take a full-length timed sitting early in the week and sort every miss into one of the six domains. Fix the biggest cluster, then sit a second paper. A practice paper is useful for pace as well as content: sixty questions in ninety minutes leaves no room for rereading scenarios. When you are ready to measure yourself, the CIS-TPRM practice exam gives you a timed run to find the domains that still cost you marks.

The last two days

Stop adding material. Reread your near-synonym pairs, your one-page lifecycle and your error log. Check your booking time and your identification, and, if you are sitting online, your room and connection. Sleep matters more than a final cram, because scenario wording rewards a rested reader.

What goes wrong in the exam room, and how do you read around it?

Most lost marks come from reading, not knowledge. Read the final sentence of a scenario first so you know whether it is asking for the best configuration, the first step, or the cause of a problem. Then read the details with that question in mind. Eliminate options that build a custom solution where configuration would do, options that give outside parties more access than they need, and options that skip the approval or review the scenario clearly requires.

Multiple-choice questions on this exam often include two plausible answers. The better one usually respects the order of the lifecycle: record, tier, assess, score, act, review. An option that scores before assessing, or monitors before onboarding, breaks that order. If you are stuck, ask where in the lifecycle the scenario sits, and the right answer tends to be the one that belongs at that stage.

Manage the clock deliberately. With ninety seconds on average, flag anything that takes more than two minutes and move on. Finishing a first pass with a quarter of an hour left lets you return to the flagged ones with a clear head. Avoid changing answers without a reason: your first reading of a well-prepared scenario is usually sound unless you spot a specific word you missed.

Is the credential worth adding to a risk or ServiceNow CV?

Whether it pays depends on where you work. Regulators in finance, healthcare and the public sector increasingly expect organisations to show they know who their critical suppliers are and how those suppliers were assessed. A person who can implement that on a platform the organisation already owns is useful in that environment. The credential gives an employer or client independent evidence that you understand both the discipline and the configuration, which is a rarer pairing than either half alone.

It also widens a ServiceNow career sideways. Many implementation consultants specialise in IT service management or operations. TPRM sits in the governance, risk and compliance family, where the buyers are risk, procurement and security leaders and the conversations are different. Holding a credential there can open work with a different set of customers, and the knowledge carries into related GRC applications, since the ideas of records, tiers, assessments and issues recur across them.

Be realistic about limits. The credential does not replace experience, and it does not give you a salary figure; pay depends on location, seniority and the employer. No salary figures are quoted here because none are published by the vendor for this exam. What the credential does give you is a structured way to learn a domain and a signal that you completed it. If you are weighing several ServiceNow exams, choose by the work you want to be doing next year. If that work involves supplier risk, onboarding reviews or compliance reporting, this is a sensible next exam.

What to do after you pass

Add the credential to your profile, then use it. Offer to review your organisation's tiering rules, volunteer for a questionnaire redesign, or write up an internal guide to the portal for suppliers. ServiceNow releases new platform versions regularly, so keep your knowledge current by reading the release notes for the GRC applications. A failed attempt is information: write down the areas that felt weakest straight away, rebuild the plan around them, and book again only when timed papers come back steady.

Frequently Asked Questions

How many questions are on the CIS-TPRM exam?

The ServiceNow CIS-TPRM exam has 60 questions and a 90-minute time limit, which averages ninety seconds a question. Check ServiceNow's credential page on the day you book, because the vendor can revise its exams and the live page is the final word.

What is the passing score for CIS-TPRM?

CIS-TPRM is reported as Pass or Fail, and no numeric cut-off or pass percentage is published. Judge your readiness by timed practice instead: steady results across full-length papers, plus the ability to explain why each wrong option is wrong, are a better guide than any quoted percentage.

How much does the CIS-TPRM exam cost?

The exam fee is USD $450. Training and any vouchers are separate, and ServiceNow can change prices or offer entitlements through its learning programme, so confirm the amount that applies to you on the credential page before you register.

Which CIS-TPRM domain is worth the most?

Assessment Configuration carries 33 percent of the blueprint, the largest share. It covers due diligence requests, tiering, risk calculation and assessment lifecycle. Fundamentals and review follow at 23 percent, then core configuration at 14, the portal and supporting processes at 12 each, and application relationships at 6.

Is CIS-TPRM the same as the vendor risk management exam?

They are the same line of work under an older name. ServiceNow's credential page still uses an address containing vendor risk management, while the exam and application are now called Third-party Risk Management. Check the page for the current exam title when you search training catalogues.

Select ratingPoorOkayGoodGreatAwesome

Rating: 5 / 5 (76 votes)