Vendor Risk Management: A Complete Platform

CISAPP links each vendor to your internal activities, to its assessments and to its score, so you see your organisation's real exposure rather than a list of contracts.

By the activity it supports, not the contract value: data access, role in a critical process, availability of an alternative. A cheap provider with no fallback is a [vendor SPOF](/en/glossary/vendor-spof).

Yes. The risk register and dependency mapping identify the most critical vendors so assessment effort concentrates there, rather than treating every third party the same way.

Frequency follows criticality: annually for critical third parties, less often for others, and off-cycle on events — reported incident, hosting change, acquisition, certificate expiry.

It must be formally accepted, along with its compensating measures, by a named owner — the traceability of that decision is exactly what an auditor looks for, and what CISAPP retains.