Vendors, contracts and access reviews · Autessa IT Desk
Vendor risk management
Autessa IT Desk includes vendor risk management: each vendor has a tier, criticality, the kinds of data it handles and a risk rating from weighted security and privacy questionnaires. Signing off an assessment turns its findings into vendor issues with remediation due dates and sets the next review date from the vendor's tier.
The problem
Every new tool is a new place your data lives
Third-party risk reviews usually live in spreadsheets and email threads. Questionnaires go out and come back with no consistent score, findings are never followed up, and nobody remembers when each vendor is due for review again.
What you get
- Vendor records with tier (1, 2, 3), criticality, status, data handled (from public to payment cards, health data, credentials and source code), attestation (SOC 2 Type 1 or 2, ISO 27001), DPA signed and contacts.
- Versioned questionnaires with sections, weights and the answer that counts as risky.
- Evidence uploads per question.
- A score from 0 to 100 and a rating: Low, Medium, High or Critical, with configurable thresholds.
- Sign-off turns findings into vendor issues with severity and a remediation due date.
- The next assessment date follows the vendor's tier and the assessment kind.
- A vendor page with the risk overview, renewal timeline, documents, contracts, assessments, issues, software and CIs.
How it works
How does vendor risk management work in Autessa IT Desk?
Add the vendor
Record the vendor's tier, criticality, the data it handles and its attestation.
Start an assessment
From the vendor page, start a security or privacy assessment. It uses the current version of the questionnaire.
Answer and attach evidence
Fill the questionnaire, upload evidence per question, and watch the risk score update as you go.
Send for review and sign off
A vendor manager or IT administrator signs it off. Risky answers become vendor issues, the vendor's rating and last-assessed date update, and the next due date is set.
Remediate
Work vendor issues through Open, In remediation, Risk accepted and Closed before their due dates.
Every option
Scoring and cadence
| Option | What it does |
|---|---|
| Answer types | Yes / no, Choice, Text, Number, File. |
| Risky answer rules | Yes/no: the risky answer. Choice: any listed choice. Number: <N, <=N, >N, >=N. Text and file: empty is risky. |
| Required questions | An unanswered required question always counts as a "not answered" finding. |
| Score | Risky weight divided by total weight, times 100. 0 means no risk found. |
| Rating | Low below 25, Medium from 25, High from 50, Critical from 75 (thresholds configurable). |
| Finding severity | By question weight: Critical 9+, High 6+, Medium 3+, else Low. |
| Remediation days | Critical 14, High 30, Medium 90, Low 180. |
| Cadence (months) | Security and privacy: tier 1 and 2 every 12, tier 3 every 24. Access reviews: tier 1 and 2 every 3, tier 3 every 6. |
| Versions | A questionnaire version used by any assessment is frozen; edits create the next version. |
Permissions
Who can do what?
| Role | Can |
|---|---|
| Vendor manager | Manage vendors, contracts, assessments, questionnaires and vendor issues, and sign off assessments. |
| IT administrator | Everything a vendor manager can do. |
| IT agent | View vendors and their software and CIs. |
AI assist
How the IT Desk Assistant helps
On an assessment or vendor page, the IT Desk Assistant can summarize the findings and open issues, and draft notes for the vendor. It can read an uploaded document for you during the conversation.
The assistant acts as you, with your role. It fills forms but never saves them, and anything risky waits for you to press Confirm.
About the IT Desk Assistant →Connected
How it connects to the rest of IT Desk
IT DESK FEATURE
Contracts
The vendor page shows its contracts and renewal timeline.
IT DESK FEATURE
Access reviews
Access reviews are the third assessment kind, run per app.
IT DESK FEATURE
Software
Each app links to its vendor.
IT DESK FEATURE
Vendor risk dashboard
Vendors by tier and risk, open issues by severity, and renewals coming up.
AUTESSA PRODUCT
Autessa Drive
Keep the full evidence library in Drive alongside the files attached to each assessment.
FAQ
Questions about vendor risk management
Does Autessa IT Desk do vendor risk management?
Yes. It scores vendors with weighted security and privacy questionnaires, turns findings into issues with remediation dates, and schedules the next review by tier.
Can I write my own questionnaire?
Yes. Under Settings, Questionnaires, add sections and questions with an answer type, weight and risky answer. Starter questionnaires are included.
Who fills in the vendor questionnaire?
Your vendor manager, in IT Desk, from the vendor's answers and evidence, so every assessment and its evidence stay in one place.
What happens to findings?
On sign-off each finding becomes a vendor issue with a severity and a remediation due date that you track to closed or risk accepted.
100% customizable, code and all
Make Autessa IT Desk fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours