Getting Started

Vendor Management

Is your vendor a subprocessor, a reseller or storing PII?
What counts as a vendor — and what doesn't
Answer the questionnaire yourself or send it to the vendor?
What does a vendor review need before I can complete it?
Setting the vendor risk level — and when to override the AI
Collecting vendor security reports (SOC 2, SOC 3, ISO, pentest, service agreement)
Vendor review findings and the Risk Register ('Add to Register')
Review cadence and 'Due for Review': when the next review starts and why the status changes
Assigning a vendor owner and who can manage vendors
What do Active, Inactive and Off Boarded mean — and when should I delete a vendor instead?

Frameworks, Controls & Tests

How UprootSecurity grades your version control Telling UprootSecurity which CI checks to look for Why we grade pull requests, not your main branch Building a release process when you don't have one Which repositories are graded, and how to take one out of scope What UprootSecurity reads from your repositories Setting up your checks: what each one should do

MCP

VCS - Version Control System | Uprootsecurity

VCS - Version Control System

S

By Santhosh

7 articles

How UprootSecurity grades your version control