Software Vendor Registry

This is the help text the console shows in the help panel on this page.

The Vendor Registry lists the software vendors you depend on, with a risk tier and the status of your security assessment of each. It supports your third-party risk management.

What You Track

• Vendor name, Website and Type: Open Source, Commercial or Internal.
• Risk tier: Tier 1 — Critical, Tier 2 — High or Tier 3 — Standard, based on the vendor’s access to data and how critical the system is to you.
• Assessment status: Not Started, In Progress or Completed.
• Open findings: The number of open vulnerability findings tied to the vendor.
• Notes: Context about the vendor’s security posture, contracts or SLAs.

Using the Registry

• Click Add Vendor to create an entry; use the search box to find one. Members and system managers have read-only access.
• During a high-profile supply chain attack (like Log4j), search the registry to see which vendors you track and how critical each is.
• Supports ISO 27001 supplier and ICT supply chain controls (for example A.5.21).