Vendor Management provides comprehensive third-party risk assessment and monitoring capabilities, enabling organizations to evaluate, monitor, and manage risks associated with critical business relationships. This module integrates directly with your asset inventory and Crown Jewel priorities to ensure vendor risk management efforts focus on relationships that could impact your most critical business functions.

Purpose: Systematically assess, monitor, and manage third-party vendor risks through structured evaluation processes, documentation management, and ongoing risk monitoring.

Vendor Management Workflow

Step 1: Add Vendor Information Begin vendor risk management by capturing essential vendor details and business context:

Basic Vendor Information:

• Vendor Name: Official company name and any operating entities
• Business Contact Information: Primary points of contact and communication details
• Business Relationship: Nature of services or products provided
• Vendor Classification: Type of vendor (technology, professional services, infrastructure, etc.)
• Contract Details: Agreement terms, renewal dates, and financial arrangements

Asset Relationship Mapping:

• Supported Assets: Systems and applications that depend on the vendor
• Crown Jewel Connections: Direct relationships to your most critical business assets
• Service Dependencies: Critical business functions that rely on vendor services
• Geographic Scope: Locations and jurisdictions where vendor operates

Step 2: Complete Vendor Inherent Risk Questionnaire (VIRQ) Conduct initial risk screening through a structured questionnaire that evaluates fundamental risk factors:

VIRQ Assessment Categories:

Data Sensitivity: "Will the vendor access, process, or store confidential or regulated data?"

• Evaluates potential data exposure and privacy risks
• Considers regulatory compliance requirements (GDPR, LGPD, HIPAA, PCI DSS)
• Assesses data handling and protection capabilities

Network Connectivity: "Will the vendor have access to internal systems or networks?"

• Identifies potential cybersecurity risks from network access
• Evaluates system integration security requirements
• Considers remote access and VPN connectivity risks

Certifications & Compliance: "Does the vendor maintain certifications, such as SOC2, ISO, PCI DSS, EU-US DPR, or similar?"

• Assesses vendor's formal security and compliance posture
• Validates commitment to industry-standard security practices
• Provides foundation for trust and risk mitigation

Geographical Risk: "Is the vendor based in a high-risk or embargoed jurisdiction?"

• Evaluates geopolitical and regulatory risks
• Considers data sovereignty and cross-border transfer implications
• Assesses potential sanctions or trade restriction impacts

VIRQ Scoring and Risk Calculation: The platform automatically calculates an inherent risk score based on questionnaire responses, providing initial risk classification and recommendations for further assessment requirements.

Step 3: Choose Assessment Approach Based on VIRQ results and business requirements, select the appropriate vendor assessment method:

Option A: Vendor-Provided Assessment Use when expecting the vendor to complete comprehensive security questionnaires themselves.

Assessment Configuration:

• Assessment Template: Select from available frameworks (Tier 1, Tier 2, custom assessments)
• Language Preference: Choose assessment language (English, Spanish, others available)
• Recipient Management: Add multiple vendor contacts for questionnaire completion
• Due Date: Set completion timeline based on business requirements
• Custom Messaging: Provide context and instructions for vendor completion

Vendor Communication Process:

• Automated email delivery with secure questionnaire link and one-time passwords
• Progress tracking and reminder capabilities
• Vendor self-service completion with save-and-resume functionality
• Completion notifications and result integration

Option B: Internal Review Assessment Use when conducting vendor assessment internally using available documentation and artifacts.

Document Upload and Management:

• Artifact Collection: Upload vendor-provided security documentation, certifications, and compliance reports
• Document Organization: Categorize and tag documents for easy reference and audit trails
• Version Control: Track document updates and maintain historical records
• Access Control: Manage document visibility and sharing permissions

Internal Risk Assessment:

• Residual Risk Evaluation: Determine remaining risk after considering vendor's security controls
• Risk Decision Framework: Select appropriate risk treatment (Accept, Mitigate, Transfer, Avoid)
• Internal Comments: Document assessment rationale and decision-making process
• Risk Score Assignment: Apply calculated or manually adjusted risk ratings

Step 4: Assessment Review and Decision Review completed assessments and make informed decisions about vendor relationships:

Assessment Analysis:

• Automated Risk Scoring: Review platform-calculated risk scores based on assessment responses
• Gap Identification: Identify specific security control deficiencies or compliance gaps
• Crown Jewel Impact: Understand how vendor risks could affect your most critical assets
• Comparative Analysis: Compare vendor performance against industry benchmarks and other vendors

Risk Decision Options:

• Approve: Accept vendor relationship based on acceptable risk levels
• Approve with Conditions: Accept with specific risk mitigation requirements
• Request Remediation: Require vendor to address identified deficiencies before approval
• Reject: Decline vendor relationship due to unacceptable risk levels

Remediation Management: When requesting remediation:

• Specific Gap Documentation: Detail required improvements and compliance gaps
• Timeline Establishment: Set deadlines for remediation completion
• Progress Tracking: Monitor vendor progress on required improvements
• Re-assessment Triggers: Schedule follow-up assessments to verify remediation

Vendor-Asset-Crown Jewel Integration

Comprehensive Risk Visibility: Vendor Management integrates with Asset Management and Crown Jewel priorities to provide holistic risk visibility:

Asset Relationship Mapping:

• Direct Asset Support: Vendors directly supporting specific systems and applications
• Indirect Dependencies: Secondary vendor relationships through asset dependencies
• Service Delivery Impact: Understanding how vendor issues could affect business operations
• Risk Inheritance: Assets inherit risk characteristics from their supporting vendors

Crown Jewel Risk Correlation:

• Critical Asset Protection: Prioritize vendor assessments based on crown jewel relationships
• Business Impact Assessment: Understand vendor risk in context of critical business functions
• Risk Aggregation: Combine vendor risks with asset vulnerabilities for comprehensive risk calculation
• Executive Reporting: Provide clear visibility into vendor risks affecting most critical business assets

Risk Register Integration:

• Automated Risk Creation: Vendor assessment results automatically generate relevant risk register entries
• Risk Prioritization: Vendor-related risks prioritized based on crown jewel relationships and business impact
• Treatment Tracking: Monitor risk mitigation activities related to vendor management decisions

Assessment History and Monitoring

Ongoing Vendor Relationship Management:

• Assessment History: Complete record of all vendor assessments and decisions over time
• Performance Trending: Track vendor security posture improvements or deterioration
• Renewal Planning: Assessment scheduling aligned with contract renewal cycles
• Regulatory Reporting: Audit-ready documentation of vendor risk management activities

Assessment Types and Frequency:

• Initial Onboarding: Comprehensive assessment for new vendor relationships
• Annual Reviews: Regular reassessment for ongoing vendor relationships
• Event-Driven: Assessments triggered by security incidents, contract changes, or regulatory updates
• Risk-Based Scheduling: Assessment frequency based on vendor risk levels and business criticality

Documentation and Compliance:

• Audit Trail: Complete record of assessment decisions and rationale
• Regulatory Compliance: Support for frameworks requiring vendor risk management (SOX, PCI DSS, etc.)
• Evidence Management: Centralized storage of vendor security documentation and certifications
• Reporting Capabilities: Executive and regulatory reporting on vendor risk posture

Business Value: Vendor Management provides systematic evaluation of third-party risks affecting your organization, prioritized focus on vendors supporting crown jewel assets, streamlined assessment processes with automated risk scoring, and comprehensive documentation supporting compliance and audit requirements.

Screenshot needed: Vendor overview interface showing assessment options, VIRQ questionnaire, and vendor-provided assessment configuration