Questions, answered

Click Get started, then use Proto to configure Vendor IT Security Assessment for your business. Begin with one vendor questionnaire, one inspection subject, named owners and the current assessment procedure.

It identifies the vendor, version, due date, owner and review state. Control answers and their evidence link to that questionnaire.

Each answer has a risk rating. The Reviewer can inspect high and critical answers with their written response, attachment and parent questionnaire before deciding the questionnaire outcome.

Yes. An inspection has a subject reference and type. Agree a naming convention so the subject remains clear when the Reviewer opens its checks.

The Inspector records the result and observation. The Reviewer can link a nonconformance to the inspection and assign corrective work with an owner and due date.

The Corrective Action Owner records implementation. The Reviewer examines effectiveness against the linked nonconformance before approving closure.

Each finding belongs to an audit and has a requirement, finding text, severity, owner, due date and closed date.

An acknowledgment links a person to a controlled document and records its date. Keep document versions distinct so the record shows which procedure the person acknowledged.

Choose an exchange channel with the vendor during setup. The Inspector places each answer and attachment under the correct questionnaire version for review.

Use a pilot with the named Inspector, Reviewer, Assessment Owner and Corrective Action Owner. Check their working queues and direct record access with a representative case.