Vendor Risk Assessment Questionnaire Template: A Comprehensive Guide

Reviewing a vendor’s security practices is critical for ensuring compliance with critical standards including a Third-Party Risk Management component, such as NIS2, HIPAA, DORA, and the GDPR. This template example will help you get started evaluating the cyber risk exposures of your vendors.

Vendor security questionnaire template for risk assessments

The following third-party security assessment questionnaire can be used as a template for your vendor risk assessments. For an editable version, download your free template here.

Information security and privacy questions

• Does your organization process personally identifiable information (PII) or protected health information (PHI)?
• Does your organization have a security program? If so, what standards and guidelines does it follow?
• Does your information security and privacy program cover all operations, services, and systems that process sensitive data?
• Who is responsible for managing your information security and privacy program?
• What controls do you employ as part of your information security and privacy program?
• Please provide a link to your public information security and/or privacy policy.
• Are there any additional details you would like to provide about your information security and privacy program?
• What is your process for data classification? What security measures are in place to protect each classification level?
• How do you ensure remotely accessed sensitive data (such as data accessed from mobile devices) is secured?
• Do you employ any anonymizing techniques, such as data masking? If so, describe the systems in which these techniques are implemented.
• Do any of your third-party vendors have access to your sensitive data? If so, what categories of sensitive data do they have access to?
• How do you ensure your third-party vendors that process your sensitive data have proper cybersecurity measures in place?
• What user authentication techniques or access control strategies are you implementing to prevent unauthorized access?
• Do you implement Data Loss Prevention (DLP) strategies to defend against exfiltration?
• How do you ensure that only the minimal personal information is collected and processed? How do you define “minimal level”?

Physical and data center security questions

• Are you in a shared office?
• Do you review physical and environmental risks?
• Do you have procedures in place for business continuity in the event that your office is inaccessible?
• Do you have a written policy for physical security requirements for your office?
• Is your network equipment physically secured?
• What data center providers do you use, if any?
• How many data centers store sensitive data?
• What countries are data centers located in?
• Are your data centers certified by any industry standards (e.g., ISO 27001, SSAE 16)?
• Are there any additional details you would like to provide about your physical and data center security program?
• Where is sensitive information physically stored?
• Is physically stored sensitive information segmented from general access network regions?
• How do you ensure the security of any personal data transferred between physical devices?
• Do you have any surveillance cameras in place? Where are they positioned, and how long is the footage retained?
• Are any of your surveillance devices IoTs?
• How often do you conduct physical security audits?

Web application security questions

• What is the name of your application? And what does it do?
• Do you have a bug bounty program or other way to report vulnerabilities?
• Does your application have a valid SSL certificate to prevent man-in-the-middle attacks?
• Does your application require login credentials?
• How do users get their initial password?
• Do you have minimum password security standards?
• How do you store passwords?
• Do you offer single sign-on (SSO)?
• How can users recover their credentials?
• Does your application employ a defense in depth strategy? 
• How do you regularly scan CVE for known vulnerabilities?
• How do you do quality assurance?
• How do you ensure data is transferred securely between APIs and other third-party integrations?
• Do you have a Web Application Firewall (WAF) implemented?
• How do you track end-of-life web server software and outdated web dev libraries?
• Do you employ penetration testing to test the integrity of sensitive data security controls?
• Who can we contact for more information related to your web application security?
• How do you ensure the timely installation of web application security patches?
• What types of data processing activities do you perform for different types of users (visitors, customers, etc.)?
• How do you ensure separation of duties in your application development and deployment processes?
• How do you gather user consent to process personal data?
• What measures are in place to prevent session hijacking?
• Do you implement input validation measures to prevent input-based attacks, such as SQL injection, keylogging, and Cross-Site Scripting (XSS)?

Infrastructure security questions

• Do you have a written network security policy?
• Have you ever experienced a data breach? If so, what was the impact, and how was it addressed?
• Do you use a VPN?
• Do you employ server hardening?
• How do you keep your server operating systems patched?
• Do you log security events?
• What operating systems are used on your servers?
• Do you back up your data?
• How do you store backups?
• Do you segment your network to obfuscate access to sensitive resources?
• Do you test backups?
• Who manages your email infrastructure?
• How do they prevent email spoofing? e.g. DMARC
• Do you employ intrusion detection and prevention systems (IDPS)?
• How do you handle end-of-life hardware and ensure data is securely wiped?
• How do you protect employee devices from ransomware and other types of malware?
• What operating systems do employee devices use?
• Are employee devices encrypted?
• Are user logins managed in a centralized solution?
• How do you ensure secure configurations for all network devices, including routers, switches, and firewalls?
• How do you monitor for suspicious activities or infrastructure anomalies?
• Do you have an Incident Response Plan in place? How often is it tested?
• Do you have a disaster recovery plan in place? How often is it tested?
• How often do you review and update firewall rules and configurations?
• Do you employ a third party to test your infrastructure security?
• Who can we contact regarding infrastructure security?
• What security measures are in place to defend against malware injections, ransomware attacks, and other malicious threats?

Don't forget to download your free vendor risk assessment template. To keep learning about risk assessments and questionnaires, read on.

Step-by-step guide: Creating and implementing vendor risk assessment questionnaires

To move beyond simply sending a template, security and compliance teams need a clear, repeatable process for developing and administering these critical assessments.

1. Define the scope and objectives

Before you send a single question, you need to understand why you are sending it.

• Identify regulatory requirements: Determine the specific standards the assessment must satisfy (e.g., HIPAA, DORA, GDPR).
• Determine business objectives: Define the purpose of the assessment—is it for initial due diligence, an annual security review, or a high-risk deep dive?
• Categorize vendors: Assess the vendor's criticality (e.g., are they providing a core service?) and the data sensitivity they will be exposed to (e.g., PII, PHI). This categorization determines the required rigor of the questionnaire.

2. Select or develop the questionnaire

Don't reinvent the wheel; start with proven frameworks and tailor them to your needs.

• Start with industry-standard frameworks: Use templates such as the Standardized Information Gathering (SIG) Lite/Core, the Consensus Assessments Initiative Questionnaire (CAIQ), or NIST 800-171 as your base.For more options, see Top Vendor Assessment Questionnaires.
• Tailor the questions: Adjust question phrasing to ensure clarity and relevance to your specific vendor’s service offering.
• Group questions logically: Organize the questions into clear domains (e.g., Security Program, Data Management, Incident Response) for easier completion and review by the vendor.

3. Establish a clear scoring methodology

A simple checklist isn't enough; you need a way to quantify risk.

• Assign weighted scores: Assign weighted scores to questions based on criticality (e.g., compliance questions relating to GDPR may be weighted higher than general security questions).
• Define risk thresholds: Establish thresholds for acceptable risk scores.
• Implement a flagging system: Define a system for immediately flagging high-risk or non-compliant responses that require immediate follow-up.

4. Administer the questionnaire

Effective administration is crucial for achieving timely and accurate results.

• Communicate clearly: Inform the vendor of the assessment's purpose and expected timeline.
• Centralize the process: Utilize a dedicated platform to manage the exchange of questions, answers, and supporting evidence, thereby avoiding error-prone email and spreadsheet workflows.
• Request Supporting Evidence: For critical security control questions, specifically request supporting evidence (e.g., policy documents, certification reports) to substantiate your response.

5. Analyze and validate responses

Verification is mandatory; a vendor's self-assessment is just one data point. For more guidance, read more on third-party risk assessment best practices.

• Review and score: Review all answers against your established scoring methodology.
• Validate key claims: Confirm that key security control claims are supported by the requested evidence.
• Identify discrepancies: Compare the questionnaire results (the vendor's internal view) with continuous monitoring and security rating data (an external, objective view) to identify discrepancies. For example, if a vendor claims to have flawless patching but has a low security rating due to unpatched systems, this requires immediate investigation.

6. Determine the final risk rating and remediation plan

The assessment should conclude with a clear action plan.

• Assign a comprehensive risk rating: Assign a final risk rating based on the total data gathered from the questionnaire, evidence, and monitoring tools.
• Develop a risk treatment plan (RTP): For unacceptable risks, develop a clear RTP detailing specific, measurable corrective actions the vendor must take.
• Define a re-assessment schedule: Establish a schedule for re-assessment and continuous monitoring to confirm that all remediation steps are complete and the risk posture has improved.

Common challenges and solutions

Even with a strong process, managing vendor risk questionnaires presents challenges. Here are the most common and how to address them:

Real-world examples of successful questionnaire application

These examples show how organizations leverage the questionnaire process to manage specific regulatory or business risks effectively:

Case Study 1: Financial services compliance focus (DORA)

• Challenge: A financial firm needed to ensure all third-party data processors complied with DORA (Digital Operational Resilience Act) standards before onboarding. This is critical for demonstrating operational resilience, a key DORA requirement.
• Solution: The firm utilized a custom questionnaire based on the SIG Core framework, specifically weighting questions related to operational resilience and incident reporting higher than those related to general security practices. The tool automatically calculated a risk score, immediately flagging any vendor that fell below the critical threshold for an in-person audit and a mandatory remediation plan.

Case Study 2: Rapid onboarding for SaaS vendors

• Challenge: A growing tech company needed to rapidly vet low-risk SaaS vendors (used only for internal operations, no PII) without slowing down the business. A full, time-consuming assessment was unnecessary for these low-criticality vendors.
• Solution: They used SIG Lite and leveraged a Trust Exchange platform. Vendors were able to upload pre-completed questionnaires and existing security documentation, significantly reducing their completion time. This enabled the company to approve 90% of low-risk vendors within 48 hours, thereby streamlining the business process without compromising security.

‍

What is a vendor risk assessment questionnaire?

A Vendor Risk Assessment (VRA) questionnaire (also known as a third-party risk assessment questionnaire) is a structured document designed to gather information about a third-party vendor’s security controls, compliance posture, and data handling processes. It serves as the foundational tool for any comprehensive Third-Party Risk Management (TPRM) program, providing the initial perspective needed to evaluate a potential partner.

It is designed to help your organization identify potential weaknesses among your third-party vendors and partners that could lead to a data breach, data leak, or other types of cyber attacks.

The results of the questionnaire are used to perform due diligence and calculate an initial risk score for the vendor. This score helps determine whether the vendor's security measures meet your organization’s required standards and risk appetite before you formalize a partnership.

‍

Vendor risk assessment questionnaires are typically organized into four sections:

1. Information security and privacy
2. Physical and data center security
3. Web application security
4. Infrastructure security

Types of questions included

Questionnaires shift the burden of proof to the vendor, requiring them to attest to their security practices and procedures. While the specific questions vary, they generally seek to confirm that the vendor has a robust security program in place.

Examples of the types of questions typically included are:

• Incident response: Do you have an incident response plan, and how often is it tested?
• Security frameworks: What security frameworks does your organization comply with (e.g., ISO 27001, NIST CSF)?
• Data handling: How is customer data stored, encrypted, and accessed (e.g., at rest and in transit)?
• Governance: Who has ultimate responsibility for the organization's information security program?
• Vulnerability management: What is your process for managing vulnerabilities in your software and infrastructure?

Tailoring Questions Based on Risk and Criticality

Not every vendor requires the same level of scrutiny. Effective organizations tailor the depth of their questionnaires based on a risk-based tiering process, primarily determined by vendor criticality and data sensitivity.

• Vendor criticality: A vendor providing core, customer-facing services is often deemed high-criticality and requires a comprehensive assessment, such as the SIG Core questionnaire. Conversely, a low-risk vendor (e.g., an office supply provider) may only require a simplified, Lite version of the questionnaire.
• Data Sensitivity: Questions must directly align with the type of data the vendor will access and process. For example:
  
  • Assessments for vendors processing EU citizen data will include specific questions on data localization, transfer, and data subject rights to ensure GDPR compliance.
  • Vendors handling patient data must answer detailed questions on access control, encryption, and audit logging to verify HIPAA compliance.

Why are third-party risk assessment questionnaires important?

Third-party risk assessment questionnaires are essential tools for assessing potential risks and ensuring data privacy standards with new vendors before forming partnerships. These questionnaires offer a structured and consistent method to evaluate vendor security postures as part of a third-party risk management (TPRM) program, especially in industries with strict regulatory requirements (such as HIPAA for healthcare organizations).

Security questionnaires play a crucial role in third-party risk assessments by gathering information about a vendor's security control strategy. The data collected from security questionnaires creates a window into a vendor's security practices, contributing to the definition of their security posture.

The importance of this process extends across compliance, data protection, and ongoing partnership management:

Compliance and regulation

Questionnaires serve as auditable proof of due diligence. By collecting data on security controls, organizations demonstrate they are actively working to meet regulatory standards like HIPAA, DORA, and GDPR. This documentation is crucial for auditors, regulators, and stakeholders.

Data protection and risk mitigation

• Risk Identification: Questionnaires help your organization identify potential weaknesses among your third-party vendors and partners that could result in a data breach, data leak, or other type of cyber attack.
• Proactive Strategy: Risk assessments ensure each vendor’s information security standards contribute to a proactive incident response and disaster recovery strategy.
• Trust and Transparency: The process fosters a collaborative environment, establishing a baseline for a secure working relationship and encouraging vendors to be transparent about their security posture.

Connection to the TPRM Lifecycle

Questionnaires are not a standalone tool but a critical element in the broader vendor lifecycle:

• Onboarding and tiering: They are used for initial due diligence, helping security teams determine the vendor's risk level and classify them (risk-based tiering) before forming a partnership.
• Data consolidation: A fundamental rule of vendor security assessments is to combine as many data sources as possible to produce the most accurate vendor risk profile. Other vendor security data sources commonly combined with security questionnaires include automated scanning results, previously completed questionnaires, certifications, and information from Trust and Security pages.
• Ongoing monitoring: The results provide a baseline that is then verified against continuous monitoring and security ratings. This ongoing verification ensures that any critical security risks surfacing between scheduled risk assessment dates will be promptly detected.

Related: Creating a Vendor Risk Assessment Framework (6-Step Guide)

Watch this video to see how multiple vendor security data streams can be consolidated into a single third-party risk assessment workflow.

Get a free trial of UpGuard >

What are the downsides of vendor risk assessment questionnaires?

While valuable, vendor risk questionnaires come with a variety of challenges. These security questionnaires are notoriously labor-intensive to manage and offer only a snapshot of a vendor’s cybersecurity posture throughout its lifecycle.

Thankfully, these problems can easily be addressed with a two-stage strategy:

1. Combine point-time risk methods with continuous monitoring

A vendor questionnaire alone will only collect data about a vendor’s cybersecurity practices on the date of the risk assessment. Any critical security risks surfacing between risk assessment schedules will not be detected, leaving your organization exposed to unknown data breach threats during these periods.

However, when combined with a continuous monitoring solution, such as security ratings, security teams achieve real-time awareness of the company’s evolving third-parry risk exposure, allowing vendor risks to be promptly detected and remediated before they develop into costly data breaches.

2. Leverage security questionnaire automation

Replace legacy vendor risk assessment methods, such as spreadsheets and manual processes, with automation technology specifically designed to improve the speed and accuracy of vendor risk assessments. Security questionnaire automation also establishes the foundation of a scalable TPRM program, allowing a risk management policy to scale alongside even the most ambitious business growth objectives.

To start leveraging questionnaire automation, sign up to UpGuard’s Questionnaire AI automation tool, Trust Exchange, for free.

Sign up to Trust Exchange for free >

How can my organization build a robust third-party risk management program?

The first step towards building a robust third-party risk management program is to use an industry-standard questionnaire and then adapt it to your organization’s needs. It’s difficult to clearly understand a vendor’s internal network security, data security, and information security without asking for additional information, which is why questionnaires are a great starting point for risk assessment processes.

Here are five industry-standard security assessment methodologies you can start with:

1. CIS Critical Security Controls (CIS First 5 / CIS Top 20):  The Center for Internet Security (CIS) offers a set of 20 prioritized controls designed to protect systems and data from cyber threats. These high-impact controls align with major frameworks like NIST, ISO 27000, PCI DSS, and HIPAA.
2. ‍Consensus Assessments Initiative Questionnaire (CAIQ): Developed by the Cloud Security Alliance, CAIQ provides a standardized set of questions to evaluate security controls for cloud providers (IaaS, PaaS, SaaS).
3. ‍NIST 800-171: NIST 800-171 provides guidelines to protect controlled unclassified information (CUI) in nonfederal organizations, with 14 security objectives. Compliance is required for organizations working with the DoD, GSA, and NASA. This free questionnaire template can help you confirm each vendor's level of alignment with NIST 800-171.
4. ‍Standardized Information Gathering Questionnaire (SIG / SIG-Lite): Created by the Shared Assessments Program, SIG assesses vendor cybersecurity, data security, and resiliency; SIG-Lite is a simplified version for low-risk vendors.
5. ‍VSA Questionnaire (VSAQ): Published by the Vendor Security Alliance in 2016, VSAQ is designed to monitor supplier security practices across six sections, including data protection, security policies, and supply chain compliance.

You can extract thousands of potential questions from these frameworks and adapt them to align with your organization's needs and priorities. However, security questionnaires are only part of the solution.

Investing in a real-time vendor monitoring tool allows organizations to streamline assessments, track security posture changes, and request remediation for high-risk issues. These tools can detect threats such as DMARC, CVE vulnerabilities, phishing, malware, domain hijacking, SSL, DNSSEC weaknesses, and other cyber risks.

Why you should consider using security ratings alongside security questionnaires

Security ratings allow risk management and security teams to monitor vendor security posture continuously. Unlike questionnaires, security ratings are automatically generated, frequently updated, and provide a shared language for both technical and non-technical stakeholders. Gartner even predicts that cybersecurity ratings will soon be as important as credit ratings in evaluating business relationships, becoming a standard due diligence measure for both service providers and procurers.

These ratings address gaps left by traditional assessment methods, such as SIG or VSA questionnaires, which are time-intensive and can lack accuracy. Security ratings offer an independent, up-to-date verification of questionnaire results, enhancing reliability.

According to Gartner, cybersecurity ratings will become as important as credit ratings when assessing the risk of existing and new business relationships.

Learn about UpGuard's security rating >

FAQs about vendor risk assessment questionnaires

What is a third-party risk assessment questionnaire?

A third-party risk assessment questionnaire is part of a formal vendor risk assessment. These questionnaires give security analysts deeper insights into each vendor's specific cyber and regulatory risks. Questionnaires align with various standards, ranging from frameworks such as ISO 27001 to regulations like PCI DSS and HIPAA.

What is a vendor risk assessment questionnaire? 

A vendor risk assessment questionnaire is a tool used to evaluate the security practices, data handling, and compliance of third-party vendors.

What is a TPRM questionnaire? 

A TPRM (Third-Party Risk Management) questionnaire assesses the risks associated with third-party vendors, focusing on cybersecurity, data protection, and regulatory compliance.

How do you create a vendor risk assessment questionnaire?

To create a third-party risk assessment questionnaire, you need to:

• Choose a specific cybersecurity or regulatory standard you want to evaluate a vendor's security posture against - some examples include. ISO 27001, NIST CSF, PCI DSS, HIPAA, and NIST 800-53.
• Design questions that strategically uncover risks of misalignment against your chosen security or regulatory standard. 
• Have a system for determining the severity of uncovered risks and their potential impact on your organization. Such a system will either be based on qualitative or quantitative risk measurement methods. 
• Implement remediation processes to rapidly address discovered risks that exceed your third-party risk appetite. 

‍

How do you write a risk assessment questionnaire? 

To write a risk assessment questionnaire, define key risk areas, create questions covering security, compliance, and data privacy, and ensure alignment with industry standards.

What are the main challenges of vendor risk assessment questionnaires?

Conventional vendor risk assessment questionnaire processes pose significant challenges to third-party risk assessment efficiency due to the following common bottlenecks:

• Inefficient vendor communication workflows occurring via email rather than within a Vendor Risk Management solution.
• Generic questionnaires failing to consider each vendor's unique cybersecurity context.
• Repetitive questionnaires require a significant amount of time to complete. This issue is the most frustrating for vendors, who end up continuously delaying such questionnaires in favor of more critical tasks.

How do you calculate vendor risk? 

Vendor risk is calculated by evaluating a vendor’s security controls, the potential impact on business operations, and the likelihood of a security incident based on questionnaire responses and security ratings.

What are the four main sections of a third-party risk assessment? 

The four main sections typically include security policies, data protection, compliance, and incident response.

What are the main challenges of a vendor risk assessment questionnaire? 

The main challenges include the time required to administer, inconsistent responses, and difficulty verifying accuracy.

What are the 9 steps to conducting a vendor risk assessment?

• Step 1: Gather data about the vendor's security practices
• Step 2: Identify all high-risk vendors
• Step 3: Send all high-risk vendors a comprehensive risk assessment
• Step 4: Review vendor questionnaire responses against your risk management framework
• Step 5: Establish the basis of a risk treatment plan for the vendor
• Step 6: Consolidate your risk treatment strategy in the form of a risk assessment
• Step 7: Present the risk assessments for critical vendors to stakeholders for review
• Step 8: Establish an ongoing risk assessment schedule prioritizing critical vendors
• Step 9: Continuously monitor critical vendors 

‍

What types of vendors should complete a risk assessment questionnaire?

All vendors should be assessed, but the type of questionnaire should be based on a risk-based tiering process. High-tier vendors (e.g., those handling PII/PHI or providing mission-critical services) require a comprehensive assessment.

How often should vendor questionnaires be updated or re-evaluated?

The questionnaire template should be updated annually or when new regulations emerge. Vendor responses should be re-evaluated annually for most, semiannually or quarterly for high-risk vendors, and immediately following any major vendor security incident.

What’s the difference between a vendor questionnaire and a full audit?

A questionnaire is a self-assessment/attestation that gathers information about controls, while a full audit is a more resource-intensive, independent verification (such as a SOC 2 audit) that tests those controls.

‍

Streamline your vendor risk assessments with UpGuard

UpGuard's natively integrated workflows streamline the entire VRM process, helping you achieve a more efficient and scalable Vendor Risk Management program.

The goal is to shift from manual, error-prone spreadsheet and email workflows to a single, scalable platform. UpGuard’s platform emphasizes automation and centralization to provide significant benefits for security and compliance teams:

Time savings through automation

• AI-powered efficiency: Replace legacy vendor risk assessment methods, such as spreadsheets and manual processes, with automation technology specifically designed to improve the speed and accuracy of vendor risk assessments. Questionnaire AI tools can pre-fill known data or compare new responses against previous ones, minimizing the burden on both your team and the vendor.
• Scalable TPRM: Security questionnaire automation lays the foundation for a scalable TPRM program, enabling a risk management policy to scale in tandem with even the most ambitious business growth objectives.

Accuracy and visibility

• Comprehensive risk profile: A fundamental rule of vendor security assessments is to combine as many data sources as possible to produce the most accurate vendor risk profile. UpGuard provides a single, visual dashboard to combine questionnaire results with security ratings and continuous monitoring data.
• Continuous monitoring: Unlike questionnaires, which provide only a point-in-time snapshot, security ratings enable risk management and security teams to continuously monitor vendor security posture, achieving real-time awareness of evolving risks.
• Adaptability: The platform is designed to support all major frameworks (SIG, CAIQ, NIST) and allows for quick, risk-based customization of questionnaires to suit any regulatory requirement.

Efficient remediation workflow

In the Risk Management phase of the workflow, all detected risks are assigned a severity rating and ranked according to their criticality. This allows for the efficient development and tracking of RTPs with vendors.

The UpGuard workflow integrates multiple data sources to assess and manage risk:

‍

Phase 1: Evidence selection

The Evidence Selection phase aggregates data from multiple sources to establish a vendor’s risk profile.

‍

Some examples of vendor security posture data sources that can be supplied in the evidence selection phase include:

1. Automated Scanning Results

A list of security risks and vulnerabilities discovered through automated non-invasive scans of the vendor’s external attack surface.

2. Risk Modifications

Any information provided by the vendor about compensating security controls reducing the severity of security risks discovered through questionnaires.

3. Security Questionnaires

A list of security questionnaires used to uncover deeper security risk insights not discoverable through high-level attack surface scans.

Your chosen set of security questionnaires will depend on the risk categories each vendor relationship will likely be exposed to.

4. Additional Evidence

The additional evidence section pulls data from any additional relevant security resources, offering additional context about a vendor's security posture.

Some common examples of additional evidence resources include:

• Cybersecurity audits
• Certifications
• A vendor’s public-facing web page showcasing their security or compliance-related documentation.

5. Trust and Security Pages

This evidence collection source pulls data from a vendor’s Trust and Security page, if one is available. Trust and Security pages overview the objectives and risk management efforts of a vendor’s cybersecurity program. With sufficient information, a Trust and Security page could significantly reduce the complexity of security questionnaires in an initial risk assessment.

Phase 2: Risk Management

In this phase, all risks detected from the evidence-collection phase are assigned a severity rating and ranked by criticality to support risk management decisions.

‍

For more information, read our related post on our vendor risk management dashboard.