How it Works

Sprinto’s Vendors module enables you to track and manage the risks associated with third-party vendors. It streamlines the entire vendor lifecycle—from discovery to ongoing assessment—helping you stay compliant with frameworks like SOC 2, ISO 27001, HIPAA, and GDPR.

Here’s how it works:

Step 1: Discover vendors used across your organisation

Connect your SSO provider (Google Workspace, Okta, or Office 365) to automatically identify third-party applications accessed by your team.

• View discovered vendors under the Vendor discovery tab.
• Choose to Add, Dismiss, or Validate each vendor.
• Manage connected domains from the Manage Vendor Discovery panel.

Step 2: Add vendors to Sprinto

Add vendors using one of the following options:

• Vendor Library – Select from Sprinto’s curated list of vendors.
• Bulk Upload – Use the CSV template to add multiple vendors at once.
• Manual Entry – Enter vendor details directly in the UI.

All added vendors appear under the All vendors tab.

Step 3: Configure and apply vendor risk scoring

Sprinto auto-scores vendors based on:

• Type of data shared (e.g., credentials, cardholder data)
• Operational impact
• Access to company systems

You can override scores, add custom risk factors, or edit responses under the Configuration tab.

Step 4: Assign vendor admins

Each vendor is assigned a Sprinto admin responsible for completing risk checks and due diligence. Vendor admins are notified via email and tracked under the All vendors section.

Step 5: Complete due diligence

Evaluate vendor security posture by:

• Uploading documents manually
• Requesting documents via email
• Using Sprinto AI to analyse reports and generate findings

Track progress under the Due diligence tab for each vendor.

Step 6: Send and review security questionnaires

Create or upload a custom security questionnaire and send it to vendors. Vendors respond via a secure link. You can review, download, and export their responses from the Vendor security questionnaire tab.

Step 7: Monitor breaches and incidents

View vendor-related breach alerts under the Breach monitoring tab. Each entry includes:

• Impacted vendor
• Reported date
• Source of breach
• Actions taken (manually added)

You can also enable breach notifications for your team.

Step 8: Perform periodic vendor risk assessments

Use the Vendor risk assessment tab to:

• Review all active vendors
• Exclude vendors from a cycle
• Track due diligence status
• Complete and submit assessments for review