Understand the certification
Certification Overview
ServiceNow Certified Implementation Specialist - Vendor Risk Management (CIS-VRM) is about building a workable third-party risk process on the platform. The exam covers vendor onboarding, assessment questionnaires, scoring, tiering, monitoring, and contract-related follow-up. In practice, this is a TPRM exam. You are expected to understand why a vendor is assessed, how risk is classified, and how monitoring changes once a supplier is considered critical.
Exam Domains
- Vendor Lifecycle Management: vendor and contact records, onboarding, maintenance, offboarding, and supporting documentation
- Assessment Questionnaires: templates, question types, portals, scoring rules, reassessments, and due dates
- Vendor Tiering and Classification: tier logic, categories, critical vendor handling, and monitoring depth
- Ongoing Monitoring: schedules, monitoring tasks, external signals, alerts, and follow-up
- Contract Compliance: vendor contracts, attestation, SLA and KPI monitoring, and renewal visibility
- Reporting: vendor risk posture, third-party summaries, issue tracking, and executive reporting
Who Is This For
This certification fits VRM consultants, procurement compliance teams, third-party risk analysts, security managers, and GRC practitioners who handle vendor oversight rather than internal control programs.
Exam at a glance
- Exam code
- CIS-VRM
- Provider
- 其他
- Format
- Single choice / Multiple select
- Language
- English
- Validity
- 3 years
- Exam fee
- $250
Skills in focus
Learning outcomes
- Earn the ServiceNow CIS-VRM certification
- Build and manage vendor onboarding, assessment, and monitoring workflows in ServiceNow
- Set up tiering and scoring models that reflect real supplier risk
- Track contract and attestation obligations for third-party governance
- Improve your fit for VRM, TPRM, and procurement compliance roles
Who this is for
- ServiceNow VRM consultants implementing third-party risk workflows
- Procurement compliance teams and third-party risk analysts
- Security managers responsible for supplier and supply-chain risk oversight
- GRC professionals extending from internal compliance into vendor risk management
Before you start
- CSA is required before taking CIS-VRM
- You should understand basic TPRM and vendor assessment workflows
- Familiarity with procurement, contracts, or supplier compliance is useful
- General awareness of third-party requirements under privacy and security regulation helps
- Hands-on exposure to VRM or similar third-party risk tooling is recommended
Your learning path
3 chapters
Plan your preparation
- Learning hours
- 20h
- With relevant experience
- 8-10 weeks
- Starting from scratch
- 12-16 weeks
- Daily study
- 1-2h
Included in your preparation
- Vendor lifecycle coverage from onboarding through reassessment and offboarding
- Direct work on questionnaire design, scoring rules, and vendor risk classification
- 59+ scenario-based questions on tiering, monitoring, contracts, and vendor follow-up
- Clear separation between VRM for third parties and RC for internal control work
- Mock exam aligned to the official 60-question, 90-minute format
Preparation tips
- 60 题 90 分钟，平均每题 2 分钟，合理分配时间
- 及格分 70/100，不确定的题先标记跳过，回头再做
- 排除法非常有用 — 先排掉明显错误的选项，剩下的再分析
- 多选题会告诉你选几个，仔细看题目要求
Common mistakes
- 没有读完所有选项就选答案 — 题目经常有"最佳"答案和"正确但不最佳"的干扰项
- 备考只刷题不理解原理 — 考试场景题需要理解底层概念
- 忽略时间管理 — 在难题上卡太久，导致后面简单题没时间做
Before you register
What core content does the ServiceNow CIS-VRM exam cover?
CIS-VRM tests implementation skills for the ServiceNow Vendor Risk Management module, including: Vendor lifecycle management (onboarding, assessment, offboarding), Risk assessment questionnaire configuration, Vendor tiering and classification, Contract compliance tracking, Continuous monitoring and alerting, and VRM reporting and dashboards. The focus is on third-party risk identification, assessment, and mitigation processes.
What are the passing criteria and cost for CIS-VRM?
The exam contains 60 questions in 90 minutes with a passing score of 70%. The exam fee is $250 USD. Questions focus on vendor management scenarios, requiring you to select the best ServiceNow VRM configuration based on enterprise third-party risk management requirements.
What prerequisites are needed for CIS-VRM?
You must first pass the ServiceNow CSA (System Administrator) certification. Third-party risk management (TPRM) fundamentals, understanding of vendor assessment processes and compliance requirements, and ServiceNow platform configuration experience are recommended. Candidates with backgrounds in procurement management, supply chain management, or information security compliance will find it easier to get started.
What is the difference between CIS-VRM and CIS-RC? Which should I take first?
CIS-VRM focuses on third-party vendor risk management, while CIS-RC focuses on internal enterprise risk and compliance management. There is no required order; the choice depends on your job responsibilities. If you primarily handle vendor management and procurement compliance, prioritize VRM. If you handle internal risk control and auditing, prioritize RC.
Why is vendor risk management becoming increasingly important?
Recent years have seen frequent supply chain attacks (such as SolarWinds), and regulatory requirements for third-party risk management are becoming increasingly strict. Organizations need systematic TPRM processes to manage vendor data security, compliance, and operational risks. CIS-VRM certification proves your ability to build such management systems on the ServiceNow platform.
How do I renew CIS-VRM certification?
CIS-VRM certification is valid for 3 years. Renewal requires passing a Delta exam or retaking the full exam. ServiceNow releases two major platform versions annually, and Delta exams primarily cover feature updates and improvements to the VRM module in new versions.
Learner experiences
Loading reviews…
Start with the first chapter.
2 free chapters · Full preparation from $39