About

Vendors is your client's register of the third parties they rely on, such as contractors and software or online services. Use it to record each vendor, assess its security and compliance posture, and connect vendor-related risks to your risk register. That way, the risk a vendor brings shows up alongside the rest of your client's risks.

Super Admins and Compliance Managers manage vendors.

Open Vendors

1. In the sidebar, under Manage, select Vendors. It sits with Risks, Controls, Assets, People and Trust, and does not depend on the framework you have selected.
2. Choose a tab at the top of the page: Dashboard, List or Assessments.

The Dashboard tab

The Dashboard gives you the vendor risk picture on one page:

• Risk Summary: the overall vendor risk, and the total number of vendors.
• Risk Assessments Overview: how many vendor risk assessments are Active, Future, Completed or Overdue.
• Vendor Risks by Tiers: a grid of vendor counts by risk level and by how critical the vendor is. Select a count to see those vendors.
• Risk by Assessment Area: vendor risk scores for each assessment area. It stays empty until assessment-area scores are available.
• Top 10 Riskiest Vendors: the vendors with the highest risk scores, with each vendor's status. Select Go to all vendors to open the list.
• Top Company Risks Due to Vendors: company risks that are linked to one or more vendors. Select Go to all Risks to open the risk register.

The List tab

The List tab shows every vendor record. Use the controls above the table to work with it:

• Search vendors and Filter: find the vendors you want.
• Display: choose which columns to show.
• Export: download your vendors.
• Import CSV: add many vendors at once.
• Create vendor: add a single vendor.

The table shows these columns:

• ID, Name and Tier.
• Quick Assessment: how many answers are Yes, Partial, No and N/A.
• Status.
• Risk Score.

Select a column header to sort by it, for example to put the highest Risk Score first. Select a vendor to open its record.

Add a vendor

1. Select Vendors › List › Create vendor. The "Add vendor" panel opens.
2. To add a vendor from the catalog, search for it in Search vendors or scroll the catalog, then select Add under the vendor.
3. To add a vendor that is not in the catalog, select Add manually, then enter the vendor's name, contact name and contact email, and add a logo.

To bring in many vendors at once, select Vendors › List › Import CSV.

Vendors from your Tech Stack

When you share a Tech Stack with a client from the MSP portal, its vendors are added to the client's vendor list automatically. You do not add them yourself, and there is no button for it in the client's Vendors page. These vendors work as follows:

• They show a "Partner managed" label, and the stack's products are attached to the vendor.
• If the client already has a vendor with the same name, that vendor becomes partner managed.
• You cannot select a partner managed vendor for bulk actions in the list.
• The Products tab on a vendor's record shows for partner managed vendors, and for any vendor that already has products.

The vendor record

Select a vendor in the list to open its record. It has seven tabs:

• Properties: the vendor's details.
• Products: the vendor's products.
• Quick Assessment: a short first-pass questionnaire.
• Risk Assessment: a full, scheduled assessment.
• Risks & Action Items: the risks linked to the vendor and the action items that address them.
• Comments: discussion about the vendor.
• Activity: the history of the record.

At the top of the record, the arrows beside Prev and Next move to the vendor before or after this one in the list.

Assess a vendor

1. Open the vendor from the list.
2. On the Properties tab, fill in the vendor's details: Status, Tier, Type, Internal owner, Tags and Notes. Select Add contact to add a contact.
3. Run the quick assessment for a first look. See "Run a quick assessment" below.
4. If the results call for more, create a full risk assessment. See "Run a full risk assessment" below.
5. On the Risks & Action Items tab, link the vendor to risks and track the action items that address them.
6. Use the Comments tab to discuss the vendor and the Activity tab to review the history of the record.

Run a quick assessment

The quick assessment is a short list of questions about the vendor, such as whether it stores personal or health information, whether a contract is in place, and whether it has a SOC 2 report. For each question:

1. Open the vendor's Quick Assessment tab.
2. Select the answer: Yes, No, Partial or NA.
3. Optionally, select Add notes to record a note.
4. Optionally, add supporting documents: drag and drop files into the Documents area, or select it to choose files from your device or cloud storage.

Each question shows its own Risk Score and the date it was last answered. The answers also appear in the Quick Assessment column of the list.

Run a full risk assessment

1. Open the vendor and select the Risk Assessment tab.
2. Set the key dates for the assessment.
3. Pick a questionnaire.

To see every vendor risk assessment in one place, select the Assessments tab on the Vendors page. It lists assessments that are active, future, completed or overdue. The Dashboard counts them in Risk Assessments Overview.

Link vendor risks

1. Open the vendor and select the Risks & Action Items tab.
2. Link the vendor to the risks in your risk register that it affects.
3. Track the action items that address those risks on the same tab.

Risks you link to vendors count in the Risks dashboard, and appear under Top Company Risks Due to Vendors on the Vendors Dashboard.