Vendor Risk Management
Assess, monitor, and manage third-party vendor security risk. Automate vendor questionnaires and continuous monitoring to protect your supply chain.
Third-Party Risk Management
Your security is only as strong as your weakest vendor. Axura helps you assess and continuously monitor the security posture of your third-party vendors and suppliers.
Vendor Inventory
Centralized database of all vendors with risk classifications and contract details.
Security Questionnaires
Automated questionnaires based on industry standards (SIG, CAIQ, custom).
Auto-Assessment
AI-powered initial risk scoring based on public information.
Continuous Monitoring
Ongoing security monitoring with breach alerts and certificate tracking.
Document Management
Store and track vendor SOC 2 reports, DPAs, and certifications.
Risk Scoring
Each vendor receives a risk score based on multiple factors:
| Factor | Weight | Assessment Method |
|---|---|---|
| Data Access | 30% | Type of data the vendor can access |
| Certifications | 25% | SOC 2, ISO 27001, other certifications |
| Security Posture | 20% | Questionnaire responses, external scans |
| Business Criticality | 15% | Impact if vendor is compromised |
| Contract Terms | 10% | SLAs, liability, data handling |
CRITICAL (Score 80-100)
└─ Has access to sensitive data
└─ Business-critical service
└─ Review frequency: Quarterly
HIGH (Score 60-79)
└─ Moderate data access
└─ Important but not critical
└─ Review frequency: Semi-annually
MEDIUM (Score 40-59)
└─ Limited data access
└─ Replaceable service
└─ Review frequency: Annually
LOW (Score 0-39)
└─ No sensitive data access
└─ Non-critical service
└─ Review frequency: Every 2 yearsVendor Assessment Workflow
1. ADD VENDOR └─ Basic information, category, data access level 2. AUTO-ASSESSMENT (AI-powered) └─ Public security posture scan └─ SSL certificate check └─ Breach database lookup └─ Security headers analysis 3. QUESTIONNAIRE └─ Send standardized questionnaire └─ Vendor completes online └─ AI validates responses 4. DOCUMENT COLLECTION └─ Request SOC 2 report └─ Collect DPA, certifications └─ Verify authenticity 5. RISK CALCULATION └─ Combine all factors └─ Generate risk score └─ Assign risk tier 6. CONTINUOUS MONITORING └─ Ongoing security monitoring └─ Breach alerts └─ Certificate expiry tracking
Questionnaire Templates
Axura includes industry-standard questionnaire templates:
- SIG Lite - Standardized Information Gathering (simplified)
- SIG Core - Full SIG questionnaire for critical vendors
- CAIQ - Consensus Assessments Initiative Questionnaire (cloud)
- Custom - Build your own questionnaire from templates
Continuous Monitoring
After initial assessment, Axura continuously monitors vendors for:
Security Headers
Regular checks of vendor website security configurations.
SSL Certificates
Track certificate expiration and configuration issues.
Breach Database
Alerts if vendor appears in data breach databases.
Certification Expiry
Track when SOC 2 reports and certifications expire.
News Monitoring
AI-powered monitoring for security incidents in news.
💡 Trust Center Integration
If your vendor uses Axura, you can automatically verify their compliance status through their Trust Center, eliminating the need for questionnaires.
Subprocessor Management
Track your vendors' subprocessors for complete supply chain visibility:
- Maintain subprocessor list per vendor
- Assess risk of subprocessors
- Track subprocessor changes over time
- Display in Trust Center (optional)