How it Works
Understand how Sprinto’s Vendors section helps manage third-party risk through discovery, scoring, due diligence, and monitoring.
Sprinto’s Vendors module enables you to track and manage the risks associated with third-party vendors. It streamlines the entire vendor lifecycle—from discovery to ongoing assessment—helping you stay compliant with frameworks like SOC 2, ISO 27001, HIPAA, and GDPR.
Here’s how it works:
Step 1: Discover vendors used across your organisation
Connect your SSO provider (Google Workspace, Okta, or Office 365) to automatically identify third-party applications accessed by your team.
View discovered vendors under the Vendor discovery tab.
Choose to Add, Dismiss, or Validate each vendor.
Manage connected domains from the Manage Vendor Discovery panel.
Step 2: Add vendors to Sprinto
Add vendors using one of the following options:
Vendor Library – Select from Sprinto’s curated list of vendors.
Bulk Upload – Use the CSV template to add multiple vendors at once.
Manual Entry – Enter vendor details directly in the UI.
All added vendors appear under the All vendors tab.
Step 3: Configure and apply vendor risk scoring
Sprinto auto-scores vendors based on:
Type of data shared (e.g., credentials, cardholder data)
Operational impact
Access to company systems
You can override scores, add custom risk factors, or edit responses under the Configuration tab.
Step 4: Assign vendor admins
Each vendor is assigned a Sprinto admin responsible for completing risk checks and due diligence. Vendor admins are notified via email and tracked under the All vendors section.
Step 5: Complete due diligence
Evaluate vendor security posture by:
Uploading documents manually
Requesting documents via email
Using Sprinto AI to analyse reports and generate findings
Track progress under the Due diligence tab for each vendor.
Step 6: Send and review security questionnaires
Create or upload a custom security questionnaire and send it to vendors. Vendors respond via a secure link. You can review, download, and export their responses from the Vendor security questionnaire tab.
Step 7: Monitor breaches and incidents
View vendor-related breach alerts under the Breach monitoring tab. Each entry includes:
Impacted vendor
Reported date
Source of breach
Actions taken (manually added)
You can also enable breach notifications for your team.
Step 8: Perform periodic vendor risk assessments
Use the Vendor risk assessment tab to:
Review all active vendors
Exclude vendors from a cycle
Track due diligence status
Complete and submit assessments for review
Last updated