Platform
Assess vendors by how much they matter, then keep checking.
A few questions set each vendor's criticality before anyone sends a questionnaire. The vendor answers inside the platform, VectraIQ scores and drafts the report, and your expert team reviews it before it is published.
Example Payroll Co.
Example- HighHow critical the vendor is to the company overall
- Highly sensitiveHow sensitive the data the vendor handles is
- EssentialHow essential the vendor is to the business process it supports
Step 1
Tier the vendor before you assess it.
You, not the vendor, answer a handful of questions about how much the vendor matters. The result is a criticality tier that shapes everything after it.
A few questions set each vendor's criticality, then VectraIQ scores and your expert reviews. That tier weights every response, so a gap in a mission-critical vendor outweighs the same gap in a minor one.
Step 2
The vendor answers inside the platform.
No emailed spreadsheets and no attachments to merge.
What the vendor sees
- The vendor sees which questions are left and can hand questions to colleagues.
- Answers and supporting documents go in the platform. Uploads are checked and stored privately.
What you see
Each assessment shows its progress from setup through vendor answers and expert review to completion, so you always know where it stands.
Step 3
What happens when the vendor submits.
Nothing below is retyped by hand.
- 1
Scored by criticality
Responses are scored and weighted by how much the vendor matters. A mission-critical vendor with a weak control costs more than a minor one with the same gap.
- 2
Issues and risks created
Generated from the answers and labelled with the vendor name. A required document that never arrived becomes an issue and a risk.
- 3
Added to monitoring
The vendor is enrolled in passive external monitoring, which includes its security posture, and scheduled for reassessment, annually by default.
- 4
Report drafted
VectraIQ writes the executive summary, a vendor profile and a quality review of each document.
- 5
Expert review, then publish
Your cyber expert edits the draft, removes anything wrong and publishes. You see the report only after that.
One vendor, start to finish
Example- Intake
- You add Example Payroll Co. Your answers tier it as Highly Important.
- Vendor answers
- Two vendor users answer inside the platform. No SOC 2 report is uploaded.
- Generated
- An issue, “Example Payroll Co. - SOC 2 report not provided”, and a linked risk appear in your registers.
- Review
- Your cyber expert edits the summary, drops one false positive and publishes the report.
- After
- Monitoring continues in between, and the next assessment is scheduled a year out.
The issues and risks land in your registers, where owners and dates are set. See risk management. Internal assessments use the same scoring engine: risk assessments.
Between assessments
Enrolled vendors are checked on a schedule.
Submitting an assessment enrolls the vendor in monitoring, so the report is not a snapshot of last year.
Check frequency, set by vendor criticality
Critical vendors
Daily
High
Every 3 days
Medium and low
Weekly
These are passive checks of public sources and the vendor’s own published endpoints. We never scan or probe a vendor’s systems, because they have not agreed to it. It is not a 24/7 security operations service, and it does not replace asking the vendor for evidence.
For each vendor, you see
- An external security posture score for each vendor
- Whether a cyber incident has been detected, with details if so
- A written summary of the external checks and what to consider asking the vendor
Vendor Risk dashboard
Your vendor portfolio at a glance.
Three views drawn from the assessments and checks, so you can see where vendor risk sits.
Show the dashboards
Executive Summary
Your overall vendor risk score and trend, open issues and risks, the weakest-scoring vendors, and how many vendors are critical or hold highly sensitive data.
Assessments
What is in progress, what is coming up for reassessment, what is overdue, and how long assessments take.
Security Monitoring
One vendor at a time: its external checks, a summary and what to consider asking.
Roll-ups across the whole program are covered in reporting and dashboards.
Who does what
You choose the vendors. VectraIQ does the paperwork. Your expert team owns the report.
You
- Decide which vendors matter and answer the criticality questions
- Name the vendor contacts who respond
- Read the published report and decide what to ask the vendor
VectraIQ
- Scores each response, weighted by criticality
- Checks uploaded documents against what they should contain
- Drafts the report, vendor profile and document review
- Runs the passive checks on schedule
Your expert team
- Sets up the assessment and reviews the draft report
- Edits or deletes findings before you see them
- Publishes the report and decides what to ask the vendor next
Vendor review is part of the managed program. How the platform treats your own data is on the security page.
Questions, answered.
Do vendors need to log in?
Vendor respondents answer inside the platform. They cannot open your registers or your reports.
How often is a vendor reassessed?
Annually by default, and the Assessments dashboard shows reassessments coming up and those overdue.
Do you scan or probe our vendors?
No. Monitoring uses passive checks of public sources and the vendor’s own published endpoints. We never scan or probe a vendor’s systems, because they have not agreed to it.
Which vendors should I assess first?
Start with the vendors that matter most to the business or hold your most sensitive data. The criticality questions put them at the top.
More in the platform
Where vendor findings go.
- Risk assessmentsRun a risk assessment, score it, and turn the findings into issues and risks.
- Risk managementA risk register with owners, treatment and progress, rolled up into dashboards.
- Audit and compliancePolicies, controls and evidence kept current, so audit prep is a review.
- Frameworks and controlsOne control library mapped across the frameworks you report against.
- Reporting and dashboardsExecutive dashboards and board reports drafted for your cyber expert to finalize.
- VectraIQThe AI inside the platform: ask where you stand, get insights, draft reports.
Start with the vendors that worry you most.
Tell us which vendors worry you most. We will show you how they would be tiered, assessed and monitored.