Getting Started

Vendor Management

Is your vendor a subprocessor, a reseller or storing PII?
What counts as a vendor — and what doesn't
Answer the questionnaire yourself or send it to the vendor?
What does a vendor review need before I can complete it?
Setting the vendor risk level — and when to override the AI
Collecting vendor security reports (SOC 2, SOC 3, ISO, pentest, service agreement)
Vendor review findings and the Risk Register ('Add to Register')
Review cadence and 'Due for Review': when the next review starts and why the status changes
Assigning a vendor owner and who can manage vendors
What do Active, Inactive and Off Boarded mean — and when should I delete a vendor instead?

Frameworks, Controls & Tests

MCP

Frameworks, Controls & Tests | Uprootsecurity

Frameworks, Controls & Tests

Learn everything about Compliance Frameworks and how Controls are mapped and implemented. Why these controls are needed for your Audit.

S

By Santhosh

13 articles

Controls