Vendors: Cyberwiz AI

The vendor record is the anchor for everything else in vendor management: assessments, reports and risk history all hang off it.

Adding a vendor

Create the record with a name and one contact, then fill in the rest as you learn it. Nothing beyond the name blocks you from sending a first assessment.

Each vendor holds a list of contacts with a name, role, email and phone, one of which is marked primary. The primary contact is the default recipient when you send an assessment, and the one reminders chase.

Business context

Vendor type — what the vendor provides.
Criticality — high, medium or low, your judgement of what breaks if they go down.
Agreements — contracts, DPAs and their status.

Data processing

The part that drives most of the risk picture. Record what the vendor handles — PII, sensitive PII, PHI, payment data, regulated data, employee data, telemetry, or none at all — along with the classification, the processing and data-centre locations, and the retention period.

A vendor that touches PHI in a jurisdiction you did not expect is a finding whether or not an assessment says so, so this section is worth keeping current.

Risk assessment

The risk block records how the vendor was evaluated rather than the outcome of any single assessment:

Pre-engagement assessment status and date
Last audit date, audit type, next scheduled audit
Risk rating and the methodology behind it
Who validated the result, and when
Who approved it, when, and the approval document

Keeping the next-audit date accurate is what turns reassessment into a scheduled task rather than something remembered.

Vendor status

A vendor moves through its own lifecycle independently of any assessment — an onboarding vendor with no assessment yet is a different thing from an offboarded one whose data you still hold.

The vendor page

Everything above sits on the vendor page, alongside:

Assessments — every assessment sent, with status and score.
Reports — generated reports, newest first.
Findings — open findings across assessments, so you can see what is outstanding without opening each one.
Risk snapshots — how the vendor's risk has moved over time.

Vendors