Blog
Vendor risk assessment
Due diligence, evidence, SOC reports and findings.
3 posts
Vendor risk assessment
Vendor risk assessment checklist: evidence by tier
A vendor risk assessment checklist starts with scoping and tiering, then asks for evidence matched to each tier, reviews it for scope, dates and exceptions, tracks findings and records sign-off.
Pooja Singh · VendRisk360 Marketing Team6 min read
Vendor risk assessment
SOC 2 Type 1 vs Type 2: which should you ask vendors for?
A SOC 2 Type 1 report checks control design on one date; a Type 2 also tests whether controls worked over a period. Ask important vendors for Type 2 and treat Type 1 as a first step.
Pooja Singh · VendRisk360 Marketing Team6 min read
Vendor risk assessment
What are CUECs and why do auditors ask about them?
CUECs are controls a vendor's SOC report assumes you operate. If you do not operate them, the auditor's conclusion may not hold for you, so map each one to your own control and keep evidence.
Pooja Singh · VendRisk360 Marketing Team6 min read
Get started
See VendRisk360 on your own vendors
A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.