Source: https://sprinto-test.docs-staging.pageloop.ai/data-library/vendors

# Vendors

### Introduction

Third-party vendors often have access to sensitive systems and data. From a security compliance standpoint, it’s critical to evaluate and monitor the risks associated with these external relationships. Sprinto’s **Vendors** module offers a unified, audit-ready platform to manage vendor information, assess risk, conduct due diligence, and respond to compliance requirements effectively.

### Why It’s Important

Compliance frameworks such as **SOC 2**, **ISO 27001**, **HIPAA**, and **GDPR** mandate regular evaluation and documentation of third-party risks. Without centralised oversight, tracking vendor assessments, documents, and breach incidents becomes operationally challenging and non-compliant.

Sprinto’s vendor management workflow enables you to stay ahead of these challenges with structured processes, automation, and built-in templates—eliminating the need for ad-hoc tools and spreadsheets.

---

### How Sprinto Manages Vendor Risk

The Vendors module is part of Sprinto’s broader Risk and Compliance suite. It enables you to:

- **Add and organise vendors** through discovery, library search, or bulk uploads.
- **Evaluate risk levels** using Sprinto’s scoring rubric or your own risk parameters.
- **Assign due diligence tasks**, upload or request documents, and validate security posture.
- **Send and track questionnaires**, including custom or preloaded templates.
- **Monitor breach events** tied to your vendors, sourced from verified public feeds.
- **Customise scoring models**, add custom fields, and manage vendor-specific documents centrally.

All vendor-related data is tracked and visualised for auditability, including version history, due diligence outcomes, and assessment cycles.

---

### Key Modules

| Tab                               | Description                                                                           |
| --------------------------------- | ------------------------------------------------------------------------------------- |
| **All vendors**                   | Central directory for viewing, filtering, and updating vendor records.                |
| **Monitoring**                    | Track pending due diligence, checks, and alerts in real time.                         |
| **Vendor risk assessment**        | Conduct periodic assessments and classify risk based on current vendor posture.       |
| **Vendor discovery**              | Automatically identify apps used by staff through SSO logs.                           |
| **Breach monitoring**             | View and respond to breach incidents related to vendors.                              |
| **Vendor security questionnaire** | Upload, assign, and review security questionnaires.                                   |
| **Configuration**                 | Customise risk rubrics, due diligence logic, document templates, and metadata fields. |

---

### Use Cases

| Scenario                     | Description                                                                     |
| ---------------------------- | ------------------------------------------------------------------------------- |
| **New Vendor Onboarding**    | Add a vendor and assign a default risk score and admin for oversight.           |
| **Annual Risk Reviews**      | Reassess risk profiles and complete management reviews.                         |
| **Due Diligence Automation** | Use Sprinto AI to analyse documents and generate findings.                      |
| **Audit Preparation**        | Export vendor activity, questionnaire results, and breach history for auditors. |