Vendors & risk

Third parties and risk, tied to your controls

Every vendor has a criticality, the data it touches, its assurance report and a review cycle. Every risk has an owner, a treatment and the controls that reduce it.

Frameworks Monitoring Integrations People & devices Policies Vendors & risk Access reviews Audits SOC 1 Trust Center AI questionnaires Consultancies

Inventory

The vendors you know, and the ones the IdP found

Applications your identity provider shows people using, but which are not in the vendor list, appear as Discovered SaaS with their user counts: one click adds them. Each vendor records criticality, the data types it touches, whether it is a subprocessor (listed on your Trust Center) and whether it is a subservice organization for your SOC report.

Inherent risk follows from criticality and data: critical, or high with sensitive data, is high. Critical and high vendors are due a review every year, others every two.

Vendors page: Discovered SaaS chips from the identity provider (Google Workspace 25 users, Zoom, Notion, Loom, Salesforce, Figma, HubSpot) and a vendor table with criticality, data types, SOC report, residual risk and next review, AWS and Stripe marked Subservice. — Vendors you did not know about come from the identity provider. Each vendor has a criticality, the data it touches and its SOC report on file; Datadog’s review is overdue.

Reviews

A SOC report review that records what it places on you

A review is a security review, a questionnaire (twelve standard questions to send) or a SOC report review. Completing a SOC report review records the report type, opinion and period end on the vendor, sets its expiry a year after the period end, and schedules the next review. The CUECs the vendor’s report places on you are recorded, each mapped to the control of yours that covers it.

A qualified, adverse or disclaimed opinion, or exceptions noted, opens an issue.

Amazon Web Services vendor page: critical, inherent risk high, SOC 2 Type 2 report with unqualified opinion, period end Aug 10, 2026, expires Aug 10, 2027; a complementary subservice organization controls section with ‘Physical and environmental security of data centers’; one completed SOC report review. — AWS as a carved-out subservice organization: its SOC 2 report is on file with its expiry, and the CSOC your own report assumes AWS operates is recorded beside it.

Risk register

Forty-seven risks to start, scored and treated

A library of 47 risks for a cloud company (account takeover, ransomware, vendor breach, public buckets, unpatched services, leaked secrets, key-person dependency, AI misuse) loads with likelihood and impact on a 1–5 scale and links to the controls that treat each one. Each risk carries an owner, a treatment (mitigate, accept, transfer, avoid), a plan, a residual score and a review date; accepting a risk records who accepted it.

A monitor checks that the register was reviewed in the last year and that every risk scoring 15 or more has an owner and a plan or an approved acceptance.

Risk register: 47 open, 5 critical residual; a 5×5 heat map and risks such as R-001 Account takeover through phishing or credential stuffing (20, critical), R-002 Ransomware on corporate endpoints and R-005 Cloud storage bucket exposed publicly, each with treatment, status and linked controls. — A 47-risk library scored on likelihood and impact, each risk linked to the controls that treat it. The heat map switches between inherent and residual.

How it works

Third-party assurance that feeds your own controls

A vendor’s exceptions become an issue in your own remediation queue.

Questions it answers

What you can find out

Each one is answered on a screen you can open, and most can be typed into Ask Assure as they are.

Which critical vendors are due a review?Vendors → Review due

Whose SOC report has expired?Subservice organizations’ SOC reports are current

What does AWS’s report expect of us?The review’s CUECs and the controls that cover them

Which SaaS apps are unmanaged?Discovered SaaS

Which high risks have no plan?The risk register’s critical and high residual risks

Which controls reduce ransomware risk?R-002’s linked controls and their health

Outcomes

What teams do with it

Reviews on a calendar

Every critical vendor reviewed yearly, with the report on file.

CUECs closed, not just read

Each one mapped to the control that covers it.

A risk register people maintain

Owners, plans and review dates, monitored.

Where it stops. SOC reports are read by a person: InsightAssure records the outcome and the CUECs, it does not parse the PDF. Vendor questionnaires are sent and recorded, not hosted as a portal for the vendor.

SOC 1 Trust Center Frameworks & controls Blog: SOC 1 explained