Frequently Asked Questions
Find answers to common questions about managing vendors, scoring risk, sending questionnaires, and monitoring breaches in Sprinto.
This page addresses the most frequently asked questions about using the Vendors module in Sprinto to manage third-party risk, compliance workflows, and documentation.
1. What are the different ways to add vendors in Sprinto?
You can add vendors using:
Sprinto’s preloaded Vendor Library
CSV bulk upload using a standard template
Manual entry via the Add Vendors form
Vendor Discovery, which detects vendor apps accessed through connected SSO providers
2. How is a vendor’s risk score calculated?
Risk scores are determined using a combination of predefined and custom factors, including:
Type of data shared with the vendor
Operational impact
Level of access to company systems
Responses to custom risk parameters (if configured)
You can override the auto-computed score if needed.
3. What qualifies a vendor as high-risk?
A vendor is typically flagged as high-risk if:
Critical or sensitive data is shared with them
Their services are essential to your operations
They have broad access to infrastructure or systems High-risk vendors must complete due diligence.
4. Can I request security documents from a vendor?
Yes. You can send document requests directly to vendors via email from the Vendor documents tab. Vendors can upload files through a secure, no-login portal.
5. What is Sprinto AI and how does it help with due diligence?
Sprinto AI automatically analyses uploaded security documents (e.g., SOC 2, ISO reports) and generates responses to predefined due diligence questions. You can review, edit, or supplement AI findings before completing the process.
6. How do I send a security questionnaire to a vendor?
From the Vendor documents tab:
Select Send Questionnaire
Choose a questionnaire template
Enter the vendor’s email The vendor receives a secure link to respond.
7. How do I monitor vendor status and due dates?
Use the Monitoring tab to track:
Due diligence progress
Pending risk scoring
Overdue document uploads
Incomplete questionnaires
You can also apply filters for risk level, due dates, and vendor admin.
8. What happens when a vendor is archived?
Archived vendors are removed from active assessments and monitoring cycles but remain in your database. You can restore them at any time.
9. How does Sprinto track vendor breach incidents?
Sprinto scans public sources (e.g., news, regulatory filings) and flags breaches related to vendors in your system. Breaches are listed in the Breach monitoring tab and remain visible for 90 days.
10. Who receives notifications for vendor breaches?
By default, all Sprinto admins receive breach alerts via email. You can toggle this on or off from the Breach monitoring tab by clicking Manage.
Last updated