About VendorGaps
VendorGaps is a collection of practical observations from third-party risk assessments. Most assessments contain moments where the initial answer looks straightforward until something else in the evidence, scope, service model, contract, or actual business activity makes me look again. Those are the moments I write about here. The goal isn’t to create another collection of GRC best practices or tell other practitioners how every assessment should be handled. VendorGaps is about the judgment problems I’ve actually encountered: what initially appeared to be true, what made me question it, what I looked at next, and what I was ultimately able to conclude.
I’m Shahla Mammadova Alyasiry. My work focuses on third-party cyber risk, evidence-based vendor assessments, control validation, scoping, and the practical decisions that sit between a questionnaire response and a defensible assessment conclusion. I’m particularly interested in the parts of third-party risk that don’t reduce neatly to a Yes, No, or Not Applicable answer. That includes understanding what evidence actually proves, where a service or data flow really begins and ends, which organization or control environment an assessment belongs to, and when the facts underneath an assessment have changed.
The observations published here come from situations I have personally encountered in third-party risk work. They are intentionally generalized. Vendor and customer names, identifying details, dates, internal workflows, proprietary assessment methods, contract terms, and other confidential information are removed or changed where necessary to protect the organizations involved. The point is the assessment judgment, not the identity of the parties. VendorGaps reflects my own professional observations and does not represent the views of any employer, customer, vendor, or other organization.
A lot of third-party risk work happens inside questionnaires, workpapers, meetings, evidence repositories, and assessment reports that nobody outside the engagement will ever see. The judgment behind those decisions usually disappears with them. VendorGaps is my way of preserving some of those observations. Not as universal answers. As things worth looking at twice.