93 Compliance help Concepts
Vendors and systems
Who handles your data and what you run, with owners, review dates and access checks: both lists auditors ask for.
- 1Problems the register spots by itself
- 2Suggest from what we know: vendors found in your documents, each with the quote it came from
- 3Switch between Vendors and Systems
- 4Each vendor: what data it gets, its owner, risk and next review
Screens show Fernhollow Health, a made-up company we use for demos.
- Vendors: what they do, what data they get, who owns the relationship, when it’s next reviewed, and their assurance (for example a SOC 2 report).
- Systems: who owns each one, who reviews access, and whether it uses multi-factor sign-in.
Suggest from what we know only proposes vendors and systems it found in your documents, each with the sentence it came from. Tick the ones you want and choose Add selected. Both lists download as CSV.
Set up quarterly access reviews creates a scheduled procedure that runs on the first Monday of each quarter, with a step for each system’s reviewer.
Related
More in Concepts
- Policies, drafts and versions
- Requirements and frameworks
- Risk tests
- Controls and the control matrix
- Procedures, runs, steps and evidence
- Training: listening, acknowledging, study games
- Vendors and systems
- Customer security questionnaires
- Discovery: your website and how you work
- “How we really do it” reports