Getting Started

Vendor Management

Is your vendor a subprocessor, a reseller or storing PII?
What counts as a vendor — and what doesn't
Answer the questionnaire yourself or send it to the vendor?
What does a vendor review need before I can complete it?
Setting the vendor risk level — and when to override the AI
Collecting vendor security reports (SOC 2, SOC 3, ISO, pentest, service agreement)
Vendor review findings and the Risk Register ('Add to Register')
Review cadence and 'Due for Review': when the next review starts and why the status changes
Assigning a vendor owner and who can manage vendors
What do Active, Inactive and Off Boarded mean — and when should I delete a vendor instead?

Frameworks and Controls

MCP

MCP | Uprootsecurity

MCP

Connect your AI Agent to UprootSecurity and get things done faster. All questions related to it answered.

S

By Santhosh

6 articles

Connect your AI assistant to UprootSecurity