Source: https://atomic-works-test.docs-staging.pageloop.ai/data-library/vendors/how-it-works

# How It Works

# How it Works

Sprinto’s **Vendors** module enables you to track and manage the risks associated with third-party vendors. It streamlines the entire vendor lifecycle—from discovery to ongoing assessment—helping you stay compliant with frameworks like SOC 2, ISO 27001, HIPAA, and GDPR.

Here’s how it works:

#### Step 1: Discover vendors used across your organisation

Connect your SSO provider (Google Workspace, Okta, or Office 365) to automatically identify third-party applications accessed by your team.

- View discovered vendors under the **Vendor discovery** tab.
- Choose to **Add**, **Dismiss**, or **Validate** each vendor.
- Manage connected domains from the **Manage Vendor Discovery** panel.

---

#### Step 2: Add vendors to Sprinto

Add vendors using one of the following options:

- **Vendor Library** – Select from Sprinto’s curated list of vendors.
- **Bulk Upload** – Use the CSV template to add multiple vendors at once.
- **Manual Entry** – Enter vendor details directly in the UI.

All added vendors appear under the **All vendors** tab.

---

#### Step 3: Configure and apply vendor risk scoring

Sprinto auto-scores vendors based on:

- Type of data shared (e.g., credentials, cardholder data)
- Operational impact
- Access to company systems

You can override scores, add custom risk factors, or edit responses under the **Configuration** tab.

---

#### Step 4: Assign vendor admins

Each vendor is assigned a Sprinto admin responsible for completing risk checks and due diligence. Vendor admins are notified via email and tracked under the **All vendors** section.

---

#### Step 5: Complete due diligence

Evaluate vendor security posture by:

- Uploading documents manually
- Requesting documents via email
- Using Sprinto AI to analyse reports and generate findings

Track progress under the **Due diligence** tab for each vendor.

---

#### Step 6: Send and review security questionnaires

Create or upload a custom security questionnaire and send it to vendors. Vendors respond via a secure link. You can review, download, and export their responses from the **Vendor security questionnaire** tab.

---

#### Step 7: Monitor breaches and incidents

View vendor-related breach alerts under the **Breach monitoring** tab. Each entry includes:

- Impacted vendor
- Reported date
- Source of breach
- Actions taken (manually added)

You can also enable breach notifications for your team.

---

#### Step 8: Perform periodic vendor risk assessments

Use the **Vendor risk assessment** tab to:

- Review all active vendors
- Exclude vendors from a cycle
- Track due diligence status
- Complete and submit assessments for review