These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Vendor IT Security Assessment
- Data model
The tables behind Vendor IT Security Assessment
Vendor IT Security Assessment ships with 12 tables, grouped here by the feature that uses them. Every record your team works with lives in one of them, and you can add fields and tables in Proto.
- Tables
- 12
- Features
- 6, plus shared settings
- Change it
- Add fields and tables in Proto
How the model is organised
Vendor assessment
Security questionnaires hold vendor, version, owner and status; security answers hold each control response, evidence and risk rating.
Inspection
Inspections hold scope, assignment, timing and decision state; inspection checks hold the requirement-level result.
Failure and correction
Nonconformances link to inspections; corrective actions link to the failure and named owner.
Audit
Audits define an engagement; audit findings link observations and follow-up ownership to it.
Document control
Controlled documents hold versioned files; training acknowledgments connect a document to a person and date.
People and access
People link operating staff to Users and are referenced by ownership and assignment fields.
Every table, by feature
- Questionnaire intake3
- Control responses2
- Security inspections3
- Nonconformance and correction5
- Audit work3
- Documents and acknowledgments3
- Shared and settings1
- Security questionnaires
Vendor security questionnaires issued, responded and reviewed.
Linked to People - Security answers
Individual control responses supplied against a security questionnaire.
Linked to Security questionnaires - People
Internal staff who own or perform vendor security assessment work.
Linked to Users
- Security answers
Individual control responses supplied against a security questionnaire.
Linked to Security questionnaires - Security questionnaires
Vendor security questionnaires issued, responded and reviewed.
Linked to People
- Inspections
Security inspections performed against vendor and internal subject scope.
Linked to People - Inspection checks
Individual control checks captured during an inspection.
Linked to Inspections - People
Internal staff who own or perform vendor security assessment work.
Linked to Users
- Nonconformances
Failures raised from inspection results, with severity and containment state.
Linked to Inspections - Corrective actions
Remediation work assigned to close a nonconformance, including effectiveness review.
Linked to Nonconformances, People - Inspections
Security inspections performed against vendor and internal subject scope.
Linked to People - Inspection checks
Individual control checks captured during an inspection.
Linked to Inspections - People
Internal staff who own or perform vendor security assessment work.
Linked to Users
- Audits
Scheduled audit engagements against vendor security control scope.
Linked to People - Audit findings
Observations and findings raised during an audit, with owner and due date.
Linked to Audits, People - People
Internal staff who own or perform vendor security assessment work.
Linked to Users
- Controlled documents
Version-controlled security policies and assessment procedures.
- Training acknowledgments
Evidence that a person has acknowledged a controlled security document.
Linked to Controlled documents, People - People
Internal staff who own or perform vendor security assessment work.
Linked to Users
Keys and references
The model contains 12 tables. The relationship between a questionnaire and its answers prevents a control response from floating free of its vendor review. The inspection-to-check and inspection-to-nonconformance links preserve the origin of a failed control. Corrective actions.Nonconformance points back to the failure being addressed. Audit findings.Audit identifies the engagement behind an observation. Training acknowledgments.Document and training acknowledgments.Person identify the document and person in an acknowledgment.
Migration order
- Create Users and People, checking that each working person has the intended user reference.
- Load controlled documents before training acknowledgments so every acknowledgment resolves to a version.
- Load security questionnaires before security answers, keeping vendor names and versions distinct.
- Load Inspections before inspection checks and Nonconformances; then load corrective actions against their linked failures.
- Load Audits before audit findings; check each finding’s owner and due date.
- Reconcile counts and sample the parent-child references before the first review cycle.
Set up Vendor IT Security Assessment your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.