--- sourceDocument: yokohama Combined Product Files sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/delta-xanadu-yokohama Release : - yokohama ft:locale : - en-US ft:publication_title : - yokohama Combined Product Files ft:clusterId : - delta3yx bundleId : - delta3yx --- # Combined Third-party Risk Management release notes for upgrades from Xanadu to Yokohama # Combined Third-party Risk Management release notes for upgrades from Xanadu to Yokohama {#ariaid-title1} Release version: Yokohama Updated October 8, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 9 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Combined Third-party Risk Management Release Notes for Upgrades from Xanadu to Yokohama This consolidated release note provides ServiceNow customers upgrading Third-party Risk Management (TPRM) from the Xanadu release family to Yokohama with a comprehensive overview of new features, important upgrade instructions, changes, and enhancements. It ensures customers understand the necessary sequential upgrade process, critical data migrations, and functionality improvements that support effective third-party risk assessment, compliance, and operational resilience. Show full answer Show less ## Key Upgrade Information * **Sequential Upgrades Required:** Customers upgrading from Vendor Risk Management (VRM) to TPRM must upgrade sequentially through each release (e.g., Utah to Vancouver, Vancouver to Washington DC, etc.) to ensure fix scripts run correctly and avoid data inconsistencies or broken functionalities. * **Data Migration:** After upgrading to version 20.2.4 or later, the Industry data in the Company \[corecompany\] table is automatically migrated to a new `tprmindustry` column. Customers should verify the migration, update any customizations referencing the Industry field, and then drop the old column. * **Activation:** TPRM is available through the ServiceNow Store for installation and upgrades. Quick start tests are recommended post-upgrade to validate system functionality, especially if customizations exist. ## New Features and Enhancements * **Third-party Element Collection:** Monitor third-party elements for security and compliance as part of engagement risk management. * **Risk Intelligence Report Requests:** Request and manage external risk intelligence reports and scores directly within TPRM to support informed decision-making. * **Digital Resilience Third-party Registers:** Manage ICT third-party service provider records to maintain compliance with the Digital Operational Resilience Act (DORA), including bulk creation and editing using Excel upload/download features. * **Standardized Information Gathering (SIG) Questionnaires:** Use updated SIG templates for 2025 to align with evolving regulatory standards and third-party risk governance. * **TPRM Personalized Dashboards:** Access and customize dashboards (Third-party insights and custom analytics) to analyze assessment data, enabling role-based prioritization and sharing of reports. * **Quick Start Tests:** Verify TPRM functionality after upgrades or new integrations by running provided quick start tests, which can be customized if needed. * **Microsoft Excel Questionnaire Templates:** Third-party and engagement contacts can respond to questionnaires using downloadable Excel templates and import completed responses back into the Third-party portal, enhancing flexibility. * **Pre-populate Questionnaire Responses:** Automatically fill questionnaires for engagements and entities based on completed responses associated with the same third party, improving data consistency and reducing workload. ## Changes to Existing Features * **Multiple Legal Entities in Contracts:** Third-party assessors can now add multiple legal entities using services under a single contract to enhance compliance and operational resilience tracking. * **Additional Identification for ICT Providers:** Support for multiple code types (e.g., EUID, LEI, Country code) and legal names in third-party records ensures compliance with DORA and improves data accuracy. * **New Function Type for ICT Providers:** "Business capability" added as a function type to better categorize ICT third-party service providers. * **Dashboard Access:** Personalized dashboards are now accessible directly from the Vendor Management Workspace Dashboards page for easier navigation. * **Third-party Portal Import Modal:** Enhanced to allow questionnaire responses via Excel templates, streamlining third-party data collection. ## Deprecations and Removals Starting with version 19.1.x, reminder workflows for tiering questionnaires and external assessments have been deprecated and migrated to Workflow Studio. Customized versions of these workflows will not be automatically migrated. No features were removed in the Yokohama release. ## Accessibility Improvements Enhancements in the Third-party Risk Management application include improved keyboard focus contrast and extended screen reader support, aiding users in navigating questionnaires and workspace controls more effectively. ## Practical Impact for ServiceNow Customers Upgrading to Yokohama enables customers to better manage third-party risks through enriched data collection, advanced compliance with regulations such as DORA, improved reporting and analytics, and streamlined questionnaire workflows. Sequential upgrade adherence and data migration verification are critical to maintaining data integrity and operational continuity. The new features and improvements help organizations enhance transparency, ensure regulatory compliance, and optimize third-party risk assessment processes. Consolidated page of all release notes for Third-party Risk Management from Xanadu to Yokohama. ## How to use this page To help you prepare for your upgrade, we have combined the cross-family Third-party Risk Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Xanadu to Yokohama. Tip: If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release." ## Important information for upgrading Third-party Risk Management to Yokohama Before you upgrade to Yokohama, review these pre- and post-upgrade tasks and complete the tasks as needed. {#dfrn3-thirdpartyriskmanagement-summary__entry__2} | Release | Release notes | |-|-| | Xanadu | If you are a VRM user upgrading to TPRM, when upgrading to Vancouver or later from an earlier release, you must run each upgrade sequentially to ensure that fix scripts run correctly. This means upgrading from Utah to Vancouver, Vancouver to Washington DC, and so on. If the scripts do not run in the correct order, it can result in data inconsistencies, broken functionalities, and conflicts. For more information on upgrading from VRM to TPRM, see [Third-party Risk Management upgrade information](https://www.servicenow.com/docs/access?context=grc-tprm-upgrade-info&family=xanadu&ft:locale=en-US). | | Yokohama | Upgrade information : Starting with the Vancouver release, if you're a VRM user upgrading to TPRM, from an earlier release, you must run each upgrade sequentially to ensure that fix scripts run correctly. This means upgrading from one release to the next rather than skipping to the latest release. Not running scripts in the correct order can result in data inconsistencies, broken functionalities, and conflicts. For more information on upgrading from VRM to TPRM, see [Third-party Risk Management upgrade information](https://www.servicenow.com/docs/access?context=grc-tprm-upgrade-info&family=yokohama&ft:locale=en-US). For existing TPRM customers, after upgrading to version 20.2.4, data from the Industry column in the Company \[core_company\] table is automatically migrated to the tprm_industry column. Migration can take several hours depending on the number of records in the Company \[core_company\] table. After migration, a system log message confirms that the migration is complete. Review the Company \[core_company\] table content and update any customizations referencing the Industry field to use tprm_industry. After verifying the migration and updating customizations, you can drop the Industry column. | [ ] ## New features Between your current release family and Yokohama, new features were introduced for Third-party Risk Management. {#dfrn3-thirdpartyriskmanagement-summary__entry__8} | Release | Release notes | |-|-| | Xanadu | [Third-party element collection](https://www.servicenow.com/docs/access?context=tprm-monitor-tp-elements&family=xanadu&ft:locale=en-US) : Confirm that third-party elements adhere to the same security and compliance standards as an engagement by monitoring them through TPRM. Use this data to help identify, assess, and manage the risks that are related to your engagements that depend on third-party elements. [Risk intelligence report requests](https://www.servicenow.com/docs/access?context=tprm-riskintel-using&family=xanadu&ft:locale=en-US) : Make informed decisions about working with an engagement or third party by requesting and managing risk intelligence reports or scores from external risk intelligence content providers using the Third-party Risk Management application. [Third-party risk management data model](https://www.servicenow.com/docs/access?context=tprm-data-model&family=xanadu&ft:locale=en-US) : Take full advantage of Third-party Risk Management by viewing its data model to see how you can best use it to assess, monitor, and mitigate the risks that are required for your risk management program. [Digital resilience third-party registers](https://www.servicenow.com/docs/access?context=tprm-dora&family=xanadu&ft:locale=en-US) : Create, update, and track records for digital resilience third-party registers by using the Digital resilience third-party registers application within the Vendor Management Workspace Vendor Management Workspace. You can bulk create or edit individual records for assessments, branches, contracts, functions, legal entities, supply chains, third parties, or third-party engagements using the Excel download/upload requests feature. This application helps you maintain records with information and communication technology (ICT) third-party service providers, helping ensure compliance with the Digital Operational Resilience Act (DORA). | | Yokohama | [New Standardized Information Gathering (SIG) questionnaire content](https://www.servicenow.com/docs/access?context=grc-sig-integration&family=yokohama&ft:locale=en-US) : Use the updated SIG templates for 2025 after upgrading to version 20.1.x as part of the Third-party Risk Management application. The latest SIG questionnaires help your organization stay aligned with stricter regulatory compliance and emerging third-party risk governance, covering a wide range of security and privacy concerns. [TPRM personalized dashboards](https://www.servicenow.com/docs/access?context=tprm-monitor-dashboards&family=yokohama&ft:locale=en-US) : Improve your decision-making process by exploring and analyzing your assessment data at various levels by using the Third-party insights dashboard and the TPRM custom analytics dashboard. If you have the Third-party risk manager \[sn_vdr_risk_asmt.vendor_risk_manager\] or Third-party risk assessor \[sn_vdr_risk_asmt.vendor_assessor\] role, you can create and share your own dashboards and reports. If you're a third-party risk manager, you can also customize the report layouts, widgets, and data views to prioritize key metrics and workflows that align with your individual roles and risk programs. [Quick start tests for TPRM](https://www.servicenow.com/docs/access?context=quick-start-tests-grc-vrm&family=yokohama&ft:locale=en-US) : Verify that TPRM works as expected after upgrades and deployments of new applications or integrations by running quick start tests. If you customized TPRM, copy the quick start tests and configure them for your customizations. | [ ] ## Changes Between your current release family and Yokohama, some changes were made to existing Third-party Risk Management features. {#dfrn3-thirdpartyriskmanagement-summary__entry__14} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | [Multiple legal entities making use of the services for contracts](https://www.servicenow.com/docs/access?context=tprm-drtp-reg-contract&family=yokohama&ft:locale=en-US) : If you have the third-party assessor role \[sn_vdr_risk_asmt.vendor_assessor\], add multiple legal entities that are using services as part of a contract record in the digital resilience third-party registers within the Vendor Management Workspace. Including all entities that are using services associated with a contract is essential for maintaining transparency, helping ensure compliance, and enhancing operational resilience. [Codes and additional identification information for ICT third-party service providers](https://www.servicenow.com/docs/access?context=tprm-create-ICT-thirdparty-serv-prov-form&family=yokohama&ft:locale=en-US) : If you have the third-party assessor role \[sn_vdr_risk_asmt.vendor_assessor\], help ensure compliance with DORA regulations by adding additional code types and a legal name to third-party and third-party engagement records in the digital resilience third-party registers within the Vendor Management Workspace. Include this information when the legal name of a third party differs from its commonly recognized name, or when you need to record multiple identification codes like a EUID, LEI, or Country code. When supply chain, assessment, or contract records are associated with a third party or third-party engagement using the EUID code type, all relevant fields will be automatically populated. [Function types for ICT third-party service providers](https://www.servicenow.com/docs/access?context=tprm-create-new-function-form&family=yokohama&ft:locale=en-US) : If you have the third-party assessor role \[sn_vdr_risk_asmt.vendor_assessor\], help ensure compliance with DORA regulations by using Business capability as an additional function type for function records in the digital resilience third-party registers within the Vendor Management Workspace. [TPRM personalized dashboards](https://www.servicenow.com/docs/access?context=tprm-monitor-dashboards&family=yokohama&ft:locale=en-US) : The Third-party insights dashboard and the TPRM custom analytics dashboard are now available from the Dashboards page of the Vendor Management Workspace. [Third-party portal import modal](https://www.servicenow.com/docs/access?context=tprm-excel-template-support&family=yokohama&ft:locale=en-US) : The import modal now enables you to respond to questionnaires by using a Microsoft Excel template. You can download the questionnaire, complete it according to the included instructions, and import the final version into the Third-party portal. [Pre-populate responses using questionnaires](https://www.servicenow.com/docs/access?context=tprm-assessing-tpr&family=yokohama&ft:locale=en-US) : If you have the Third-party risk assessor \[sn_vdr_risk_asmt.vendor_assessor\] or Third-party risk manager \[sn_vdr_risk_asmt.vendor_risk_manager\] role, you can enable third-party and engagement contacts to review and update responses only if necessary by pre-populating questionnaires for engagements and entities with responses from completed questionnaires that are associated with the same third party. The attachment, duration, and signature type responses are excluded. This feature also helps ensure data consistency and accuracy. [Microsoft Excel questionnaire template](https://www.servicenow.com/docs/access?context=tprm-excel-template-support&family=yokohama&ft:locale=en-US) : Streamline the due diligence process by enabling third-party and engagement contacts to respond to questionnaires using a Microsoft Excel template by downloading the questionnaire as a template, completing it according to the included instructions, and importing the final version into the Third-party portal. This feature update enhances flexibility by enabling third-party and engagement contacts to provide information outside the third-party portal. Third-party risk assessors \[sn_vdr_risk_asmt.vendor_assessor\] and Third-party risk managers \[sn_vdr_risk_asmt.vendor_risk_manager\] can access this feature and respond to questionnaires on behalf of Third-party and engagement contacts through the Vendor Management Workspace. | [ ] ## Removed Between your current release family and Yokohama, some Third-party Risk Management features or functionality were removed. {#dfrn3-thirdpartyriskmanagement-summary__entry__20} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Deprecations Between your current release family and Yokohama, some Third-party Risk Management features or functionality were deprecated. {#dfrn3-thirdpartyriskmanagement-summary__entry__26} | Release | Release notes | |-|-| | Xanadu | [Reminder workflows](https://www.servicenow.com/docs/access?context=tprm-workflow-in-workspace&family=xanadu&ft:locale=en-US) : Starting with version 19.1.x of the Third-party Risk Management application, the tiering questionnaire and external assessment reminders workflows are deprecated and migrated to Workflow Studio. If you have customized these workflows, they won't be deprecated or migrated as part of this change. | | Yokohama | No updates for this release. | [ ] ## Activation information Review information on how to activate Third-party Risk Management. {#dfrn3-thirdpartyriskmanagement-summary__entry__32} | Release | Release notes | |-|-| | Xanadu | Install Third-party Risk Management by requesting it from the ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=xanadu&ft:locale=en-US). [Quick start tests for TPRM](https://www.servicenow.com/docs/access?context=quick-start-tests-grc-vrm&family=xanadu&ft:locale=en-US). After upgrades and deployments of new applications or integrations, run quick start tests to verify that TPRM works as expected. If you customized TPRM, copy the quick start tests and configure them for your customizations. | | Yokohama | Activation information : Install Third-party Risk Management by requesting it from ServiceNow Store. Visit the [ServiceNow Store](https://store.servicenow.com/sn_appstore_store.do#!/store/home) website to view all the available apps and for information about submitting requests to the store. For cumulative release notes information for all released apps, see the [ServiceNow Store version history release notes](https://www.servicenow.com/docs/access?context=sn-store-release-notes&family=yokohama&ft:locale=en-US). Important: Third-party Risk Management is available in ServiceNow Store. For details, see the "Activation information" section of these release notes. | [ ] ## Additional requirements If any additional requirements were introduced or changed for Third-party Risk Management we have noted them here. {#dfrn3-thirdpartyriskmanagement-summary__entry__38} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Browser requirements If any specific browser requirements were introduced or changed for Third-party Risk Management we have noted them here. {#dfrn3-thirdpartyriskmanagement-summary__entry__44} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Accessibility information Review details on accessibility information for Third-party Risk Management, such as specific requirements or compliance levels. {#dfrn3-thirdpartyriskmanagement-summary__entry__50} | Release | Release notes | |-|-| | Xanadu | Accessibility improvements for the Third-party Risk Management application include the following updates. * Keyboard focus: Improved visual accessibility in the Third-party portal by increasing contrast between the focus border and white background. * Screen reader support has been extended to announce the following: * Completed status after all questions have been completed in a section of an external questionnaire in the Third-party portal. * Correct labels and other relevant information for controls, images, card regions, menu items, and links in the Vendor Management Workspace. | | Yokohama | No updates for this release. | [ ] ## Localization information If there are specific localization considerations for Third-party Risk Management we have noted them here. {#dfrn3-thirdpartyriskmanagement-summary__entry__56} | Release | Release notes | |-|-| | Xanadu | No updates for this release. | | Yokohama | No updates for this release. | [ ] ## Highlight information If there are specific highlight considerations for Third-party Risk Management we have noted them here. {#dfrn3-thirdpartyriskmanagement-summary__entry__62} | Release | Release notes | |-|-| | Xanadu | * Collect, monitor, and assess third-party elements for engagements. * Request risk intelligence reports (RIR) and scores so that you can manage and monitor your RIR requests all within TPRM. * View the Third-party Risk Management data model. * Use the Digital resilience third-party registers application to create, update, and track records for digital resilience third-party registers. See [Third-party Risk Management](https://www.servicenow.com/docs/access?context=third-party-risk-mgt-landing-page&family=xanadu&ft:locale=en-US) for more information. | | Yokohama | * Pre-populate questionnaires for entities and engagements that are associated with the same active third party by using responses from complete questionnaires. * Respond to questionnaires by using a Microsoft Excel questionnaire template. * Explore and analyze assessment data at various levels by using the Third-party insights dashboard and the TPRM custom analytics dashboard. * Stay aligned with stricter regulatory compliance and emerging third-party risk governance by using the new Standardized Information Gathering (SIG) questionnaire content available for 2025. See [Third-party Risk Management](https://www.servicenow.com/docs/access?context=third-party-risk-mgt-landing-page&family=yokohama&ft:locale=en-US) for more information. | [ ]