Third-Party and Supply Chain Risk Management for CompTIA SecurityX (CAS-005)
Nearly every enterprise breach retrospective these days turns up the same culprit somewhere in the chain: a vendor, a subcontractor, or an open-source dependency nobody was watching closely enough. CompTIA's SecurityX (CAS-005) exam treats this reality as core architecture work, not an afterthought bolted onto procurement. Objective 1.2, inside the Governance, Risk, and Compliance domain — worth 20% of the exam — asks candidates to "perform risk management activities" against a named set of organizational requirements, and third-party risk sits squarely inside that objective alongside supply chain risk, vendor risk, and subprocessor risk. This guide breaks down what SecurityX expects you to know about managing risk that lives outside your own network boundary, building on the enterprise architecture and operations concepts covered in our Zero Trust Architecture for CAS-005 guide and our look at Enterprise Data Loss Prevention strategies . Why Third-Party Risk Gets It...