Getting Started with Vendor Risk: Part 2

Set up vendor attributes, monitor and evaluate vendors

This guide discusses functionality from across product tiers and may reference functionality not available on your account.

Step 1: Set up vendor attributes

If you already have a TPRM process — excellent! The fields below will help bring your process into UpGuard. If you don’t have a process yet — the below will help you get started. 

  • Add and edit tiers. Tiers classify risk level a vendor poses to you. You’ll evaluate and prioritize vendors based on tiers. If you’re new, start by defining a few levels of risk (those will be your tiers).
  • Create labels. Add labels (tags) that help identify the access level a vendor has (e.g. what data will they be able to see). 
  • Create portfolios. Create a portfolio for each internal business unit that owns a vendor.
  • Create custom attributes. Custom attributes are fields for tracking any non-standard data. Skip these for now, or use them to bring in data from other systems via an integration.  
  • Edit the vendor relationship questionnaire (VRQ). You send the VRQ internally and you’ll use it to understand: 1) the level of data a vendor has (or will have) access to and 2) whatever you need to know to be able to tier the vendor. Tailor the form so that you get the answers you need.

Step 2: Monitor vendors

  • List vendors you work with. You can monitor vendors individually, but if you list vendors in a .csv file you can add a tier, portfolio, label etc and then bulk import the list.
  • Monitor vendors in UpGuard. Monitor vendors individually or in bulk. For each vendor, add a:
    • tier
    • label
    • portfolio
    • point of contact (this is the person at the vendor’s company who can help you get the information you need) 

Step 3: Gather evidence 

Starting with your most critical tier and working your way down: add evidence for each vendor. In tandem, you can begin remediating and waiving risks.

The goal here is to add the evidence you need to be able to determine if a vendor meets your security requirements and understand what risks there are (and if they need to be addressed).

Up next: Getting Started with Vendor Risk: Part 3