Vendor Management

Assess and monitor third-party security risks.

Overview

Vendor Management helps you:

• Track all third-party vendors
• Assess vendor security posture
• Monitor ongoing vendor risk
• Manage vendor documentation
• Meet compliance requirements for third-party risk

Navigate to Vendors in the sidebar.

Vendor Inventory

Vendor Record

Each vendor includes:

Field	Description
Name	Vendor company name
Category	Service category
Criticality	Business criticality level
Risk Tier	Assessed risk level
Status	Active, Inactive, Under Review
Owner	Internal relationship owner
Contract End	Contract expiration date
Data Access	Types of data accessed

Vendor Categories

Organize vendors by service type:

• Cloud Infrastructure: AWS, Azure, GCP
• SaaS Applications: Business software
• Development Tools: CI/CD, code repos
• Security Services: Pen testing, SOC
• Professional Services: Consultants
• IT Services: MSPs, support
• HR/Payroll: Employee systems
• Financial: Payment processors

Adding Vendors

Manual Entry

1. Go to Vendors → Add Vendor
2. Enter vendor details:
   • Company name
   • Category
   • Primary contact
   • Services provided
   • Data access level
3. Click Create

Bulk Import

Import multiple vendors:

1. Click Import
2. Download CSV template
3. Fill in vendor data
4. Upload file
5. Review and confirm

From Integrations

Professional Feature

Automatic vendor discovery requires Professional or Enterprise plan.

Auto-discover vendors from:

• Cloud provider marketplaces
• SSO provider app catalogs
• Expense management systems

Risk Assessment

Risk Tiers

Categorize vendors by risk level:

Tier	Description	Review Frequency
Tier 1 (Critical)	Access to sensitive data, business-critical	Quarterly
Tier 2 (High)	Moderate data access, important services	Semi-annually
Tier 3 (Medium)	Limited data access, replaceable	Annually
Tier 4 (Low)	No data access, commoditized	Every 2 years

Criticality Assessment

Assess vendor criticality based on:

• Data Access: What data can they access?
• Business Impact: What happens if they're unavailable?
• Compliance Scope: Are they in compliance audit scope?
• Integration Depth: How deeply integrated?
• Replaceability: How easily replaced?

Security Assessment

Evaluate vendor security:

1. Open vendor record
2. Click Assessments tab
3. Click Start Assessment
4. Complete questionnaire or upload vendor responses
5. Review and score

Assessment Questionnaire

Built-in questionnaire covers:

• Information Security: Policies, controls
• Access Management: Authentication, authorization
• Data Protection: Encryption, handling
• Incident Response: Breach notification
• Business Continuity: DR, backups
• Compliance: Certifications, audits

Trust Signals

Gather vendor security evidence:

Signal	Weight	Example
SOC 2 Report	High	SOC 2 Type II
ISO 27001	High	ISO certification
Pen Test Report	Medium	Annual pen test
Security Policy	Medium	Published policy
Questionnaire	Low	Completed SIG

Risk Scoring

Automatic risk score calculation:

Vendor: Cloud Provider X

Risk Factors:
- Data Access: Customer PII (High)
- Criticality: Business-critical (High)
- Security: SOC 2 Type II (Low risk)
- Compliance: In scope (High)

Risk Score: 68/100 (Medium)
Recommended Tier: Tier 2

Due Diligence

Initial Assessment

For new vendors:

1. Collect basic information
2. Determine criticality tier
3. Request security documentation
4. Complete risk assessment
5. Review with stakeholders
6. Approve or reject

Documentation Collection

Track required documents:

Document	Required For	Status	Expires
SOC 2 Report	Tier 1-2	Received	Dec 2026
Insurance Cert	Tier 1-3	Received	Jun 2026
Pen Test	Tier 1	Pending	-
DPA	All	Received	-
BAA	HIPAA	Received	-

Request Portal

Professional Feature

Vendor self-service portal requires Professional or Enterprise plan.

Send vendors a link to:

• Complete security questionnaire
• Upload documentation
• Update company information

Ongoing Monitoring

Continuous Monitoring

Enterprise Feature

Continuous vendor monitoring requires Enterprise plan.

Automated monitoring for:

• Security rating changes
• News alerts (breaches, incidents)
• Certificate changes
• Dark web mentions

Scheduled Reviews

Set up periodic reviews:

1. Open vendor record
2. Set review frequency based on tier
3. System sends reminders
4. Complete review checklist
5. Update risk assessment

Review Checklist

• [ ] Verify vendor still active
• [ ] Check for security incidents
• [ ] Review updated certifications
• [ ] Assess any service changes
• [ ] Update data inventory
• [ ] Confirm contract status
• [ ] Review SLA performance

Contract Management

Contract Details

Track contract information:

• Start date
• End date
• Auto-renewal terms
• Termination notice period
• Key terms

Contract Alerts

Receive notifications for:

• Contract expiration (90, 60, 30 days)
• Auto-renewal dates
• Required review periods

SLA Tracking

Monitor vendor SLA compliance:

Vendor: Hosting Provider

SLA: 99.9% uptime

Performance:
Jan: 99.95% ✓
Feb: 99.92% ✓
Mar: 99.87% ✗
Apr: 99.94% ✓

Compliance Mapping

Framework Requirements

Map vendors to compliance requirements:

SOC 2 CC9.2 - Vendor Management

Required:
- Maintain vendor inventory ✓
- Risk assessment process ✓
- Ongoing monitoring ✓
- Contract review ✓

Evidence:
- Vendor inventory report
- Assessment questionnaires
- Review documentation

Audit Evidence

Generate evidence packages:

1. Go to Reports → Vendor Report
2. Select time period
3. Include:
   • Vendor inventory
   • Risk assessments
   • Review records
4. Export for auditors

Reporting

Vendor Dashboard

Vendor Overview

Total Vendors: 45

By Risk Tier:
Tier 1 (Critical)  ███ 3 (7%)
Tier 2 (High)      ████████ 8 (18%)
Tier 3 (Medium)    ███████████████ 15 (33%)
Tier 4 (Low)       ███████████████████ 19 (42%)

Reviews Due (30 days): 5
Assessments Pending: 2
Contracts Expiring: 3

Risk Report

View vendor risk distribution:

Risk Level	Count	% of Total
High Risk	4	9%
Medium Risk	12	27%
Low Risk	29	64%

Compliance Report

Show vendor compliance status:

• Vendors with SOC 2: 28 (62%)
• Vendors with ISO 27001: 15 (33%)
• Vendors with completed assessments: 40 (89%)

API Access

# List vendors
GET /api/v1/vendors?tier=1

# Get vendor details
GET /api/v1/vendors/{vendor_id}

# Create vendor
POST /api/v1/vendors
{
  "name": "Cloud Provider Inc",
  "category": "cloud_infrastructure",
  "criticality": "critical",
  "owner_id": "user_123"
}

# Update assessment
POST /api/v1/vendors/{vendor_id}/assessments
{
  "type": "security",
  "score": 75,
  "notes": "Strong security posture"
}

# Upload document
POST /api/v1/vendors/{vendor_id}/documents
Content-Type: multipart/form-data

See API Reference for full documentation.

Best Practices

1. Inventory All Vendors: Don't miss any third parties
2. Tier by Risk: Apply appropriate scrutiny per tier
3. Collect Evidence: Gather SOC 2, ISO certs
4. Regular Reviews: Review per tier schedule
5. Track Contracts: Monitor expirations
6. Document Everything: Maintain audit trail
7. Involve Stakeholders: Security, legal, business input