Procurement and risk, on one supplier record
Know which suppliers matter most, assess them on evidence, watch them between reviews and exit them cleanly. VendRisk360 gives procurement, risk and security teams the same record for every supplier, from onboarding to offboarding.
Supplier, vendor or third party: the same risk
Procurement says supplier, security says vendor, regulators say third party. VendRisk360 keeps one record per relationship, so everyone works from the same facts.
Supplier risk management
Vendor risk management
Third-party risk management
Every stage of a supplier relationship, connected
Each stage builds on the one before, on the same record. Follow any stage to see how VendRisk360 covers it.
1. Onboard and tier
Capture what the supplier will do, the data it will hold and the services it supports. Criticality tiers the supplier from Tier 1 Critical to Tier 4 Low, and inherent risk combines the tier with its exposure.2. Assess on evidence
Request the questionnaire and evidence the tier calls for through the vendor portal, review SOC reports, penetration tests and policies, and record findings, scaled to the tier.3. Decide and contract
Sign off the assessment, accept or treat residual risk, and carry remediation commitments into the contract.4. Monitor between reviews
Watch the supplier’s attack surface, breach disclosures and financial condition from the outside, and reassess on the cadence its tier sets.5. Understand the chain
See the suppliers behind your suppliers, and where your critical services concentrate on the same provider.6. Exit cleanly
Plan and record offboarding: data return or destruction, access removal and the final decision.
Spend your effort on the suppliers that matter
Most suppliers are low risk. A few hold your data or run your critical services. Tiering puts the depth of review, monitoring and reassessment where the risk is.
- Tier from criticality; inherent risk adds exposure
- Evidence and assessment depth set by tier
- Reassessment cadence set by tier in your policy
- Residual risk after controls, signed off and recorded
Frequently asked questions
What is supplier risk management?
Supplier risk management is how an organization identifies, assesses, monitors and reduces the risks that come from the suppliers it buys from: cyber and data risk, operational and continuity risk, financial viability, compliance and reputational risk, and concentration on a few providers. It covers the whole relationship, from onboarding to exit.
Do you screen suppliers against sanctions lists?
Where Vendor Intelligence is included, suppliers are screened against the US OFAC Specially Designated Nationals list and the HHS OIG exclusion list when they are added and on an ongoing basis. Possible matches are reviewed by a person before any decision.
Can VendRisk360 assess our suppliers for us?
Yes. With Managed Vendor Risk Assessments, you onboard the supplier and VendRisk360’s certified assessors collect the evidence, follow up with the supplier, perform the assessment scaled to its tier and track findings through remediation. You keep final approval.
See your suppliers on one record
A tailored walkthrough with a third-party risk specialist, built around your program, your regulators and your vendors.