Name third parties on the architecture, email a signed questionnaire, curate answers, download one file per vendor. Not a second assessment.
A vendor is a named trading party on this assessment (AWS, Okta, Salesforce) — not a second walk of P1–P9, and not a guess from “cloud” or “SaaS”.Your organisational residual stays yours. Unassessed vendor implementation is transferred into that vendor’s file until you accept their answers.
1. Name them (P2 and P3)
When a zone or component is third-party or shared, type or pick the legal / trading name. Several components can share one name.
Empty stays UNKNOWN. The product will not infer “AWS” from a cloud zone.
In-picture presence (browser, internet, identity provider, external service) must name who is accountable before P3 Confirm advances.
Out-of-scope without third-party responsibility does not get a vendor chapter.
On the ISO matrix, default Who for those nodes is the named vendor. Rows stay grey here. Assign an individual row to this organisation only when you will measure and monitor it.
Name a vendor on Who
P3 (or the P2 responsible-party field): Who is supplier or shared, plus a named vendor you pick or add. Confirm stays blocked while an in-picture party is unnamed.
Third-party rows default to the named vendor. Change a row to this organisation only when you will measure it.
2. Do not assess their boxes as yours (P5)
Supplier-owned control rows stay visible. You cannot mark them in-place as if your organisation implemented them. Missing evidence stays UNKNOWN, not implemented.
Supplier-owned rows stay locked
P7 will typically propose transfer for those risks. That is not a second score run.
You fill organisation measures. Grey supplier-owned rows wait for the vendor questionnaire or stay UNKNOWN.
3. Ask the vendor to fill their controls (P9)
From the report panel, under Vendor questionnaires:
Enter the vendor contact email.
Email questionnaire. That sends a signed link (14 days). They do not need a Riskonami login.
They answer their ISO rows (compliant / partial / not compliant, comment, technology) — one row per product × control × ISO id. Pack measures and your residual are not on that form.
They must give respondent name and organisation on submit.
A later submit on the same link replaces the previous copy (the form warns). Resend issues a new link and revokes the old one. Revoke stops an active link.
Their answers land as a vendor_review overlay. They do not overwrite your P5 rows until you curate.
Send the vendor questionnaire
Phase 9 report panel: named vendor, email field, and Email questionnaire. Review appears when a submission is waiting.
Email questionnaire sends a signed 14-day link. Review appears on the Data overlay after a response arrives. A later send revokes the previous link.
What the vendor sees
/vendor-assessment/… signed page: their products and ISO rows only. No org residual, threats, or treatment.
They answer their ISO rows only. Contact fields are blanked here; in product they type name, email, and phone.
4. You accept or reject (still P9)
Open Review on the Data overlay. Submitted-but-unaccepted stays UNKNOWN on issued reports.
Accept — those answers may appear on the vendor pack and on overall risk / compliance views (org P5 plus accepted reviews). Residual is not silently rewritten as “theirs.”
Reject — leave the organisational picture as-is.
You can edit strength on curation; UNKNOWN stays until you accept.
Accept or reject a vendor submission
Overlay of the waiting questionnaire: accept, reject, or adjust. Issued packs use accepted rows only.
Accept absorbs answers into the vendor pack. Reject leaves the organisational picture as-is.
5. Download one file per named vendor
The Vendor control assessment download is one file per named vendor: controls they own, transferred risks, outstanding items. UNKNOWN names do not merge into one chapter.The control register lists those same vendor-held controls under the vendor’s name. Executive and engineering still report this organisation’s residual. Overall risk and overall compliance include the vendor’s control state only after you accept their answers.
Per-vendor download
P9 downloads listing a separate vendor file (not one combined “vendors” pack).
One file per named vendor. These files stay separate from the executive report.