Demo. Northwind Payroll, Inc. is a fictional vendor. Nothing is uploaded.

Home

Vendor Risk Copilot.

A first read of vendor evidence, mapped to your own third party requirements. It is a first read for an assessor, not a final assessment: a person checks everything before it counts.

  1. Step 1

    Drop in evidence

    A SOC 2 report, a policy, a configuration export, or a screenshot of a control.

  2. Step 2

    Bring your requirements

    Your own third party requirements: what you expect from every vendor.

  3. Step 3

    Get a first read

    Scope, exceptions with severity, each requirement as Met, Partial or Gap, and the questions to send next.

Try it

1. Pick a sample document

2. Your requirements

The 12 sample requirements below. In the real tool you would use your own list.

Demo only: sample data, nothing is uploaded.
Or open the full sample first read

The requirements

A sample starter set of 12. Every program has its own.

Access control 3
  • AC-1Multi-factor authentication for all workforce access to systems that hold our data.Evidence: SOC 2 control test, or identity provider settings
  • AC-2User access reviews at least every quarter.Evidence: Access review records or SOC 2 control test
  • AC-3Access removed within 1 business day of termination.Evidence: Offboarding procedure and test results
Encryption 2
  • EN-1Our data encrypted at rest with AES-256 or equivalent.Evidence: SOC 2 control description or configuration export
  • EN-2Data in transit encrypted with TLS 1.2 or higher.Evidence: SOC 2 control description or configuration export
Logging 1
  • LG-1Security logs collected centrally and kept for at least 1 year.Evidence: Logging standard or SIEM settings
Vulnerability management 1
  • VM-1Critical vulnerabilities patched within 15 days; scans at least quarterly.Evidence: Vulnerability management policy and scan records
Incident response 2
  • IR-1We are notified within 72 hours of a confirmed incident involving our data.Evidence: Contract, DPA or incident response policy
  • IR-2Incident response plan tested at least once a year.Evidence: Tabletop exercise records or SOC 2 control test
Subprocessors 1
  • SP-1Subprocessors listed, with at least 30 days notice before a new one is added.Evidence: Subprocessor list and notice terms
Data retention 1
  • DR-1Our data deleted or returned within 30 days of contract end, with written confirmation.Evidence: Contract, DPA or retention policy
Audit rights 1
  • AU-1An independent SOC 2 Type II report every year, or the right to audit.Evidence: Current SOC 2 Type II report