Getting Started

Vendor Management

Is your vendor a subprocessor, a reseller or storing PII?
What counts as a vendor — and what doesn't
Answer the questionnaire yourself or send it to the vendor?
What does a vendor review need before I can complete it?
Setting the vendor risk level — and when to override the AI
Collecting vendor security reports (SOC 2, SOC 3, ISO, pentest, service agreement)
Vendor review findings and the Risk Register ('Add to Register')
Review cadence and 'Due for Review': when the next review starts and why the status changes
Assigning a vendor owner and who can manage vendors
What do Active, Inactive and Off Boarded mean — and when should I delete a vendor instead?

Frameworks, Controls & Tests

How UprootSecurity decides whether a ticketing test passes What belongs under each ticketing label What a ticket has to contain to stand up in an audit Make the compliant ticket the default with templates and automation

MCP

Ticketing | Uprootsecurity

Ticketing

S

By Santhosh

4 articles

How UprootSecurity decides whether a ticketing test passes