Easily manage and showcase your company's security posture with the Security Profile feature in Trust Exchange. By completing your profile, you can proactively share your security information on your Trust Page, streamlining communication with customers and reducing time spent on repetitive questionnaires.
This article will show you how to add evidence, leverage AI-powered suggestions for controls and checks, and publish information to your Trust Page.
Looking for information on how to view your vendors’ security profiles in Vendor Risk? Vendor Risk help documentation is here.
What is the security profile?
Your security profile is a comprehensive list of security controls and associated checks checks. You can use it to perform a self assessment, and then publish elements of the profile to your Trust Page.
Each control has a set of nested checks, each with their own status:
- Fully Implemented: The control is completely in place, with all checks met.
- Partially Implemented: Some checks are met.
- Not Implemented: The control is not yet in place, indicating a potential risk.
- You can also mark controls or checks as Not Applicable.
Get started with your security profile
Navigate to Trust Exchange > Security Profile to get started. When first accessed, your profile will either be empty, or (if you are a Breach Risk customer) pre-populated with continuous monitoring controls.
Add evidence
To begin populating your security profile, add your security evidence. While you can also manually complete your security profile one step at a time, adding evidence allows our AI analyst to automatically provide suggested responses drawn from your documentation, saving hours of effort.
- Click on Actions > Analyze Documents and questionnaires.
- Select or upload the documents and questionnaires you want to analyze.
- Run the analysis. This can take up to ten minutes, depending on the number of sources you add.
Review AI Suggestions
After your documents are analyzed, Trust Exchange's AI Analyst will generate suggestions for controls and checks based on the evidence you provided.
You can review these AI-generated suggestions by filtering down to “Only with AI suggestions” or by scrolling through the list view.
Click on the control row to open up the full list of nested checks associated with that control. You will be able to see the status and response for each check, with AI-powered suggestions highlighted in purple. Each AI suggestion comes with a link to the cited source, which you can view by clicking on the suggestion button.
You can reject, accept, or amend this response, and also any additional information in the free text field below the check.
Publish to your Trust Page
You can publish passed checks to your Trust Page in bulk or individually. Published checks will display in an FAQs-style searchable list on your public Trust Page, with any associated evidence subject to the access or NDA requirements you have in place.
- Head into the Publish flow, either via the Actions menu at the top of the security profile home page, or via the Publish button within the individual control view.
- Choose which controls and checks you want to add to your Trust Page.
- Review the responses you've entered.
- Choose whether to publish associated evidence.
- Proceed to Publish.
Note that if you haven’t also published your Trust Page prior to this, your information will not be shareable. Go to our Trust Page article series for more information on how to publish your Trust Page.
Viewing your controls on your Trust Page
After publishing, you can see how your security profile information appears on your Trust Page.
- Check the internal view of your Trust Page to see all the controls and checks you have published from your security profile.
- Review the responses and attached evidence to ensure you’re happy with the result
- Visit your Share link to view what your published Trust Page looks like to external users.
Understanding access protections
It's important to understand what information is publicly visible versus what remains protected.
- The answers to controls and checks (their status and text responses) are public once published on your Trust Page.
- Any attached documents or questionnaires, which may contain more detailed or sensitive information, are subject to the access protections you have in place (e.g., requiring an NDA and/or access request). Trust Page admins control whether evidence is subject to access protections or not.