Step 1 — Start a New Vendor Security Review
In the global navigation, go to Company and select Vendors.
Click the vendor you want to review from your list of active vendors.
Open the Security Reviews tab.
Click New Security Review.
Enter a name for the review, then click Start Security Review.
Step 2 — Request or Upload Vendor Documents
Decide whether you need to request documents from the vendor or if you already have them on hand.
Requesting documents:
Select Yes and create a document request.
You can include a security questionnaire for the vendor to fill out. (Navigate to Company > Vendors > Settings to upload a blank copy of your security questionnaire.)
The vendor will receive an email notification and will be asked to provide the requested documents through a secure Thoropass data room.
You will receive an email once the vendor has submitted their documents.
Uploading documents yourself:
Select No and upload the documents you’ve already collected to continue with the security review.
Step 3 — Complete the Vendor Assessment
Review the documents provided by the vendor.
Answer the assessment questions, such as:
Did the vendor provide an independent attestation (audit report/certification)?
Does the report cover the scope of services your organization uses?
Were any exceptions or non-conformities identified?
Is the report sufficient to approve this vendor?
Add any notes or findings to support your review.
You can save your progress at any time and return later to complete the assessment, or click Complete Review to finalize the security review.