Quick start
Set up your organization and run a first assessment
This walks a new customer from first sign-in to a sent assessment. It takes about fifteen minutes, most of it spent describing your first vendor.
Before you start
You need an invite to an organization, or your own sign-up completed. Two-factor authentication can be enabled from Settings → Security at any point; some organizations require it before the first sign-in completes.
Set up the organization
Sign in and confirm your profile
Verify your email, then set your name and role under Settings → Profile. The name is what vendors see on the emails you send them.
Invite your team
Under Settings → Members, invite the people who will own vendors and controls. Roles decide who can send assessments and who can only read.
Set organization details
Settings → Organization holds the company name and logo used on assessment invitations and generated reports.
Run a first assessment
Add a vendor
From Vendors → Add vendor, record the vendor name, at least one contact, and the data the vendor processes. Data processed and criticality drive the risk picture later, so it is worth filling in properly.
Pick a questionnaire
Assessments are built from a questionnaire. Start from one of the supplied questionnaires; you can edit it or build your own later from the question bank.
Send it
Sending issues a tokenised link to the vendor contact and sets the assessment to Scheduled. The vendor answers in the browser — no account, no password. The token expires on the deadline you set, and reminders go out before it does.
Review the answers
Once the vendor submits, the assessment moves to Pending review. Work through the answers, request changes where an answer is thin, and attach any evidence the vendor sent separately.
Generate the report
A report renders the answers, the score and the findings into a document you can share internally or back to the vendor. See Reports.
What to do next
- Adopt a framework under Compliance and start attaching evidence to controls.
- Set a review cadence on your critical vendors so the next assessment is scheduled rather than remembered.