Vendor Management

The Vendor Management module provides a centralised registry for tracking all third-party vendors your organisation works with. Register vendors, track their lifecycle from prospect to offboarding, manage certifications, and maintain a complete record of contact and contract details.

Accessing Vendor Management

Navigate to Vendor Inventory under the Risk & Third Party section in the sidebar. This opens the Vendor Registry — your central hub for all vendor-related activities.

The Vendor Registry

The registry is a filterable table showing all registered vendors for your organisation.

Filters

Use the filter bar at the top to narrow the list:

Filter	Options
Search	Filter by vendor name
Status	All / Prospect / Active / Under Review / Approved / Suspended / Offboarded
Criticality	All / Low / Medium / High / Critical
Category	Dynamically populated from your vendors (e.g., Cloud Provider, SaaS, Consultancy)

Table Columns

Column	Description
Name	Vendor name (click to open detail page)
Category	Vendor type or classification
Status	Current lifecycle status (colour-coded badge)
Criticality	Business criticality level (colour-coded badge)
Risk	The vendor’s single authoritative risk score with a RAG-coloured pill (if assessed)
Review	Next annual review date, with a Due soon or Overdue badge when the review needs attention
Contract End Date	When the current contract expires
Contact	Primary contact person

Adding a Vendor

1. Click the Add Vendor button in the registry header
2. Complete the modal form with the vendor’s details
3. Click Save to create the vendor record

Form Fields

Field	Required	Description
Vendor Name	Yes	The vendor’s trading name
Description	No	Brief description of what the vendor provides
Website	No	Vendor’s website URL
Category	No	Classification (e.g., Cloud Provider, SaaS, Consultancy)
Status	Yes	Initial lifecycle status
Criticality	Yes	Business criticality level
Data Classification	No	Sensitivity of data shared with this vendor
Contact Name	No	Primary contact person
Contact Email	No	Contact email address
Contact Phone	No	Contact phone number
Contract Start Date	No	When the contract begins
Contract End Date	No	When the contract expires
Contract Value	No	Annual contract value in GBP

Note

The platform detects duplicate vendor names. If you attempt to add a vendor with a name that already exists, you’ll receive an error — use the existing record instead.

Editing a Vendor

1. Click a vendor row to open the Vendor Detail page
2. Click Edit Vendor to open the edit modal
3. Update the fields as needed
4. Click Save to apply changes

All fields from the add form can be updated, including status and criticality. Changes take effect immediately.

Vendor Status Lifecycle

Vendors progress through a defined lifecycle. Set the status to reflect where each vendor is in your relationship:

Status	Description	Typical Use
Prospect	Vendor under initial consideration	Pre-contract evaluation
Active	Vendor currently providing services	Normal operations
Under Review	Vendor being reassessed	Periodic review or incident-triggered
Approved	Vendor has passed assessment and is cleared	Post-assessment approval
Suspended	Vendor services temporarily halted	Pending investigation or remediation
Offboarded	Vendor relationship terminated	Contract ended or vendor replaced

Lifecycle Best Practice

Start vendors as Prospect during evaluation, move to Active when contracted, and use Under Review for periodic reassessments. Reserve Suspended for situations requiring immediate action.

Vendor Criticality Levels

Criticality reflects how important the vendor is to your business operations:

Level	Description	Example
Low	Minimal business impact if vendor is unavailable	Office supply providers
Medium	Some disruption but workarounds exist	Non-essential SaaS tools
High	Significant impact on operations	Core business applications
Critical	Business cannot function without this vendor	Cloud infrastructure, primary data processors

Setting the correct criticality level helps prioritise risk assessments and determines the depth of due diligence required.

Data Classification

Data classification indicates the sensitivity of information shared with or processed by the vendor. Set this based on the highest sensitivity level of data the vendor handles:

• Public — Non-sensitive, publicly available information
• Internal — Internal business data, not for public release
• Confidential — Sensitive business or personal data
• Restricted — Highly sensitive data (PII, financial, health records)

This classification helps prioritise due diligence and frames the vendor’s data protection risk, so it’s important to set it accurately.

Subscription Tier Limits

Note

The number of vendors you can register depends on your subscription tier:

Tier	Maximum Vendors
Free	5
Professional	100
Enterprise	999

If you reach your tier limit, you’ll need to upgrade or offboard existing vendors before adding new ones.

The Vendor Detail Page

Click any vendor row to open the Vendor Detail page. This is the primary working area for an individual vendor, structured around the vendor lifecycle: Add → Assess → Decide → Review.

Persistent Header

The header is always visible regardless of which tab you are on. It displays:

• Vendor name and category — the vendor’s trading name and classification
• Status badge — colour-coded lifecycle status
• Criticality badge — colour-coded business criticality level
• Risk score pill — the vendor’s single authoritative risk score, coloured by RAG status (e.g. Risk 12 · AMBER)
• Recommendation pill — the latest assessment’s recommendation (Approve / Conditional Approval / Reject)
• Provenance line — Assessed <date> · Review due <date>, with due soon / overdue highlighted
• Primary action button — Run AI assessment, Run annual review, or Re-run assessment, depending on where the vendor is in its lifecycle
• Edit and Delete buttons for the vendor record

Tab Layout

The detail page is organised into four tabs that follow the lifecycle.

---

Tab 1: Overview

The Overview tab provides a snapshot of the vendor’s core details and certifications.

Vendor Details card Displays the vendor’s description, website, category, and data classification.

Contact card Shows the primary contact name, email address, and phone number.

Contract card Shows the contract start date, end date, and contract value in GBP.

Certifications table Lists all tracked certifications with the following columns:

Column	Description
Certification Name	e.g., ISO 27001:2022, SOC 2 Type II
Certification Body	The issuing organisation
Status	Valid, Expired, Revoked, or Pending
Issue Date	When the certificate was granted
Expiry Date	When it expires
Certificate Number	Reference number (if available)

---

Tab 2: Assess

The Assess tab is where you run the AI assessment and read the resulting report — RAG status, recommendation, risk analysis (inherent vs residual), CIA triad controls, certifications, breach/CVE/regulatory history, mandatory actions, and research sources. While an assessment is running, this tab shows live progress.

For the full workflow, see the Vendor Risk Assessment guide.

---

Tab 3: Decide

The Decide tab captures the decision outputs of the latest assessment and your remediation tracking:

Recommendation The latest recommendation with its executive summary and, for conditional approvals, the conditions for use.

Action Items Remediation tasks generated automatically from the assessment’s mandatory actions, or added manually. Each item tracks priority, owner, due date, and status. When a new assessment completes, still-open auto-generated items from earlier assessments are superseded automatically.

Compensating Controls Where gaps are identified, compensating controls describe the gap and the mitigation measures your organisation has put in place, each with an effectiveness rating.

---

Tab 4: Review

The Review tab manages the annual review cycle:

Next Review The next annual review date — set automatically to 12 months after each completed assessment — with a Due soon or Overdue badge and a shortcut to run the annual review when it needs attention.

Assessment History Every assessment for the vendor with its type, date, status, risk score, RAG status, and recommendation.

Managing Certifications

Track your vendors’ security certifications to understand their compliance posture.

Adding a Certification

1. Navigate to the Certifications table on the Overview tab of the Vendor Detail page
2. Click Add Certification
3. Enter the certification details:
   • Certification Name — e.g., ISO 27001:2022, SOC 2 Type II, PCI DSS
   • Certification Body — The issuing organisation
   • Status — Valid, Expired, Revoked, or Pending
   • Issue Date — When the certificate was granted
   • Expiry Date — When it expires
   • Certificate Number — Reference number (if available)
4. Click Save

Certification Statuses

Status	Description
Valid	Current and active certification
Expired	Certification has passed its expiry date
Revoked	Certification withdrawn by the issuing body
Pending	Certification application in progress

Tip

The AI assessment researches the vendor’s certifications online, but tracking the certificates you hold evidence for (with expiry dates) keeps your registry authoritative and lets you chase renewals before they lapse. ISO 27001 and SOC 2 Type II are treated as the minimum certification bar in assessments.

Best Practices

Initial Setup

1. Register all existing vendors — Start by adding your current third-party relationships
2. Set criticality levels accurately — This drives assessment prioritisation
3. Add contract dates — Enables proactive contract renewal tracking
4. Record certifications — Capture any known certifications upfront

Ongoing Maintenance

1. Review vendor statuses quarterly — Ensure statuses reflect reality
2. Monitor certification expiry dates — Follow up with vendors before certificates lapse
3. Update contact details — Keep contact information current for incident response
4. Track contract renewals — Use contract end dates to plan ahead
5. Offboard promptly — Move vendors to Offboarded status when relationships end

Related Guides

• Vendor Risk Assessment — Run AI assessments, make approval decisions, and manage annual reviews
• Risk Management — Organisational risk register and 5x5 risk matrix