These cookies are required for the website to function properly. They ensure security, enable basic features like page navigation, and store user session data. You cannot disable these cookies.
- Vendor IT Security Assessment
- Who it's for
- Managed service providers
Managed service providers
A managed service provider may support several business services, so the assessment team needs to identify the exact scope under review. A questionnaire can name the provider and version while an inspection names the subject being checked. The Reviewer can then read control answers and inspection results in their own contexts before deciding whether the scoped work is acceptable.
How Vendor IT Security Assessment is set up for you
Questionnaire cycle
Assign an Assessment Owner, set a due date and capture the provider's control answers with attachments under that request.
Service inspection
Use a service-type inspection for the subject being checked, with an Inspector assigned to record results and observations.
Failure follow-up
Link a failed inspection to a nonconformance and an owned corrective action when the issue needs remediation.
Audit trail
Keep audit findings with the engagement that produced them and track each finding's owner and due date.
A managed service provider may support several business services, so the assessment team needs to identify the exact scope under review. A questionnaire can name the provider and version while an inspection names the subject being checked. The Reviewer can then read control answers and inspection results in their own contexts before deciding whether the scoped work is acceptable.
Start with one provider service whose access and evidence requirements are clear to the team. Use one questionnaire version and a short inspection scope that can be rehearsed with real control checks. Have the Inspector enter a passing result, a failed result and a not-applicable result so the Reviewer can see how each appears. The Reviewer should decide the inspection outcome only after reading the observations and evidence. If a failure is recorded, follow it through nonconformance and correction with a named owner.
For the questionnaire, ask the provider to return answers through the team's agreed channel, then enter those answers against the correct version. Examine one elevated rating before a final decision. Use the linked answers and inspection results to decide whether the reviewed service meets your criteria. Expand to other services when the team agrees on naming, ownership and evidence quality.
Features to start with
Roles on the team
- Inspector
- Runs assigned inspections and captures control evidence.
- Reviewer
- Decides inspection and questionnaire outcomes and assesses elevated control risk.
- Assessment Owner
- Owns vendor questionnaire follow-up and due dates.
- Corrective Action Owner
- Investigates linked nonconformances and records corrective work.
- Auditor
- Plans audit work and records findings for an engagement.
Set up Vendor IT Security Assessment your way.
Start free, then use Proto to change fields, steps and approvals before your team goes live.