Security Profile

• Overview
• Navigate Security Profile
• Controls and checks
• Review checks
• Mark a control as not applicable
• Change control template
   

Overview

Security Profile gives you an overall snapshot of your vendor’s security posture by assessing evidence against specified controls.

1. You’ll monitor and tier a vendor. A vendor’s tier determines what control framework they’re evaluated against. We’ve created four pre-built, default, control templates and mapped them to tiers, but you can tailor these or build your own using our library of 500+ checks.
2. Upload evidence. Evidence fuels security profile, it’s what we use to understand if (or how fully) checks are met. In most cases you’ll add evidence, but for some of our customer’s most common vendors, UpGuard has pre-added publicly available relevant evidence for you. 
3. Analyze UpGuard’s AI parses the evidence, comparing it to the designated controls. Security Profile flags risks and highlights where controls are: not, partially, or fully implemented (or where there’s no evidence).

From here, you’ll work through the evaluation and take stock of the vendor’s security posture. You can make any necessary adjustments, kick-off a remediation workflow for risks, request additional evidence and ultimately run an assessment.

Navigate Security Profile 

Security Profile is available for any vendors you’re currently monitoring.

1. Click the Vendor Risk icon in UpGuard’s left-hand navigation panel.
2. Ensure you’re on the Vendor’s tab.
3. Select a vendor (or monitor a new vendor).
4. Select Security Profile from the expanded options under the vendor’s name in the left-nav.

1. Summary. A donut chart showing: how many controls the vendor is being evaluated against, if evidence is missing or if the control is: not, partially, or fully implemented.
2. Controls. Lists all of the controls the vendor is being evaluated against. Click a control to see a description and contributing checks.
3. Control management. Shows the control template currently being used. Use this dropdown to: switch to another control template, modify the controls for this specific vendor, or manage templates.
4. Gap questionnaire details. Sent gap questionnaires appear here. Click the status to see questionnaire details.
5. Risk assessment details. Start a risk assessment from here or view details about in progress or completed assessments.
6. Evidence. Add or view evidence associated with the vendor. 
7. Domains and IPs. View or filter the vendor domains and IPs included in the evaluation.

Controls and checks 

The Controls section shows all of the controls a vendor is currently being evaluated against on Security Profile.

Control hierarchy

Security Profile uses a hierarchical structure to organize and categorize checks. From highest to lowest level:

Control statuses

Controls are assigned one of four statuses based on available evidence. Before evidence is added, the majority (or all) controls will say “No evidence”. That’s expected; statuses will start updating as you gather evidence.

Check Results

UpGuard scans evidence and uses our own automatic scanning to evaluate checks. Checks can have:

• No evidence: there is no evidence to evaluate if this check is a risk or passed.
• Risk detected: a risk associated with this check was found. You’ll see a severity associated with the detected risk.
• Check passed: no risks associated with this check were found.

Review checks 

1. Click the Vendor Risk icon in UpGuard’s left-hand navigation panel.
2. Ensure you’re on the Vendor’s tab.
3. Select a vendor (or monitor a new vendor).
4. Select Security Profile from the expanded options under the vendor’s name in the left-nav.
5. Use icons next to a Control to see if evidence is missing, ifcontrol has associated risks, or if it’s been fully implemented.
6. Click a control from the Controls list.
7. Review icons to a check’s left to see if a check passed, is a risk, or is missing evidence.
8. Click Manage risk on checks where a risk is detected. 
9. Select Request remediation or Waive this risk. Each option takes you to to corresponding workflow: either risk remediation or risk waiver.

Mark a control as not applicable

Mark a control as N/A when the vendor should not be evaluated against that control. This section is for exempting a vendor from a particular control. Alternatively, you can apply a different control template, create a custom template or edit templates to exempt the vendor from an individual check.

1. Click the Vendor Risk icon in UpGuard’s left-hand navigation panel.
2. Ensure you’re on the Vendor’s tab.
3. Select a vendor (or monitor a new vendor).
4. Select Security Profile from the expanded options under the vendor’s name in the left-nav.
5. Click a control from the Controls list.
6. Click Mark as N/A.
7. Select Yes, mark as N/A.

The control will still be visible on Security Profile (marked as N/A), and the vendor will no longer be assessed against it. Any risks associated with the control will still be visible on Risk Profile. 

Change control template

Control templates are automatically applied to a vendor based on their tier. You can update the template the vendor is being assessed against at any point.

1. Click the Vendor Risk icon in UpGuard’s left-hand navigation panel.
2. Ensure you’re on the Vendor’s tab.
3. Select a vendor (or monitor a new vendor).
4. Select Security Profile from the expanded options under the vendor’s name in the left-nav.
5. Click the dropdown showing the control template currently applied in the Controls upper-right-hand corner.
6. Select a template from the dropdown.
7. Select Switch template.

The list of controls will immediately update and you’ll see how the vendor performs against these controls.