# The analytics vendor risk exception “The analytics vendor risk exception” is a security risk and compliance manager job simulation on FinderK. You work at Brackenfield Retail Group, an original fictional company, and complete 3 assignments in about 80 minutes. It is for anyone who wants to practice security risk and compliance manager work. No previous work experience is required. - Role: Security risk and compliance manager - Industry: Cybersecurity governance - Career: Cybersecurity (https://finderk.com/careers/cybersecurity) - Level: Mid-level - Time: About 80 minutes, 3 assignments - Access: Included in Plus - Created by: FinderK - Work tools: Mail, Office documents and spreadsheets, Chat, Notes - Page: https://finderk.com/simulations/the-analytics-vendor-risk-exception - Last updated: 2026-10-10 ## Summary Marketing wants a fast growing analytics vendor live before Black Friday, and it wants 1.2 million customers' names, emails and card digits. Assess the vendor's evidence, score the risk, design the controls that would make an exception acceptable, and keep the gate shut when the vendor reveals an old incident. ## Full brief You are the security risk and compliance manager at a retailer. A marketing director wants a US-hosted analytics service live in eighteen days for the biggest campaign of the year. The vendor's questionnaire says yes to almost everything, but its evidence shows optional sign-in security, a self-assessment instead of an audit, a penetration test nineteen months old and a seven day breach notice. You score the risk, work out which controls bring it within the security chief's authority, write the exception with the marketing director as risk owner, then rescore when the vendor discloses an incident it had not mentioned. Automated checks confirm your figures and saved work; your judgement is reviewed against the standard for the role. ## What is Brackenfield Retail Group? Brackenfield Retail Group is a fictional home and garden retailer with 140 stores, a website and an app used by about 1.2 million account holders. Marketing wants a US-hosted analytics vendor live before Black Friday. This case runs from Monday 2 to Thursday 12 November 2026. The security risk and compliance manager assesses and recommends; vendor management, the chief information security officer and the risk committee approve within the third-party security policy, and the business owner accepts residual risk. ## Who do you play? You are the security risk and compliance manager in the Information security team. You assess suppliers against the third-party security policy and recommend. Vendor management approves fully compliant vendors; Ingrid Solberg approves Medium residual risk exceptions for up to 90 days; the risk committee approves High. Ravi Chandran accepts residual risk as risk owner. No customer data flows until approval is signed and every relied-on control is verified. ## What will you do? 1. 1. Assess the vendor and score the risk (25 minutes) 2. 2. Design the controls and recommend the exception (30 minutes) 3. 3. Rescore after the vendor's disclosure (25 minutes) ## Which skills will you practice? - Assess vendor controls on evidence, not answers - Score third-party risk by a defined method - Design compensating controls that change the risk - Route a risk decision to the right approver - Hold a security gate under commercial pressure ## Frequently asked questions ### How long does “The analytics vendor risk exception” take? About 80 minutes, across 3 assignments. When the time is up, you get 10 minutes to round up and submit. Pausing stops the clock. ### Is “The analytics vendor risk exception” free? No. It is included in FinderK Plus. With a free account you can also do it without grading. ### Do I need security risk and compliance manager experience? No. No previous work experience is required. The listed level is mid-level. ### What do I get when I finish? You get feedback on each assignment you submit. Completing all required assignments earns a completion certificate. It records participation and is not professional accreditation. ### Is Brackenfield Retail Group a real company? No. Brackenfield Retail Group is an original fictional company made for practice. Its coworkers may make mistakes, so check their suggestions against the evidence.